How to Use AWS Resource Control Policies to Enforce Security Guardrails
Summary
AWS Resource Control Policies can restrict resource access across an organization, including by external accounts. The article shows policy use cases and recommends reviewing access, testing in a sandbox, and rolling out changes gradually.
Key points
- RCPs set organization-wide constraints on resource access, including access by principals outside the organization; they restrict permissions rather than grant them.
- Use cases include limiting resource sharing, enforcing policy standards such as TLS requirements, and controlling access to IAM roles and OIDC integrations.
- RCPs can prevent external accounts from performing actions such as deleting objects, even when an SCP does not apply to those principals.
- RCPs lack dry-run or audit mode. Review existing access patterns with Access Analyzer and, where needed, investigate logs; CloudTrail data events are not enabled by default.
- Test policies in a sandbox, then deploy in stages from development through production to reduce the risk and blast radius of outages.
- A policy's protection can be lost if the RCP is removed, changed, or no longer applies after an account moves; denied actions may produce only a generic AccessDenied error.
Article Details
- Topic
- Using AWS Resource Control Policies (RCPs) to enforce organization-wide resource access guardrails and data perimeters