Ravi Sir's Cards › AWS
Service Control Policies
This revision card explains Service Control Policies. A lab account should not be able to disable CloudTrail or open the root region you forbid. It describes sCPs set the maximum permissions for member accounts (guardrails). They do not grant access by themselves. The how-to section covers how to attach a Deny LeaveOrganization and Deny DisableCloudTrail SCP to Sandbox OU. An example on the card is even an Administrator user in the member account cannot disable CloudTrail.
Read card text
What this card says
Why do we need it?
A lab account should not be able to disable CloudTrail or open the root region you forbid.
What is it?
SCPs set the maximum permissions for member accounts (guardrails). They do not grant access by themselves.
SCP
How to do it
Attach a Deny LeaveOrganization and Deny DisableCloudTrail SCP to Sandbox OU.
Example
Even an Administrator user in the member account cannot disable CloudTrail.