Hands-On AWS Resource Control Policies Tutorial for Restricting External Access

Summary

The tutorial demonstrates how an AWS Resource Control Policy deployed through Control Tower can block external principals from accessing S3 resources, including a test where an external account’s object retrieval is denied.

Key points

• The presenter explains that an S3 bucket policy can grant an external account access to objects, even when the resource-owning organization uses a Service Control Policy.
• The tutorial states that Service Control Policies do not directly affect resource-based policies.
• A Control Tower preventive control is enabled for an organization unit to restrict access to S3 resources to principals in the organization or AWS service principals.
• The presenter tests access before and after applying the control: an external account can retrieve an object before deployment and receives an access-denied result afterward.
• The policy is attached at the organization-unit level, providing a guardrail that applies across its targeted workloads.