What is the difference between an AWS Organizations service control policy and an IAM policy?

Resolution

AWS Organizations service control policies (SCPs) and IAM policies serve different purposes in access management. Use the following sections to understand the difference and how SCPs and IAM policies work together.

Understand how AWS Organizations SCPs work

AWS Organizations SCPs don't replace IAM policies within an AWS account. Use SCPs to allow or deny access to AWS services for individual AWS accounts or groups of accounts within an organizational unit (OU).

The specified actions from an attached SCP affect all IAM identities, including the root user of the member account. SCPs deny access to AWS services that aren't explicitly allowed by the SCPs associated with an AWS account or its parent OUs. All AWS accounts in an OU inherit SCPs associated with that OU.

For more information, see Service control policy examples.

Understand how IAM policies work

IAM policies allow or deny access to AWS services or API operations. Apply IAM policies only to IAM identities (users, groups, or roles). IAM policies can't restrict the AWS account root user.

For more information, see Example IAM identity-based policies.

Understand how SCPs and IAM policies work together

When a user in an AWS Organizations member account requests access to a resource, AWS evaluates both SCPs and IAM policies together. The user receives only the permissions that both policy types allow.

For an action to be permitted, both the IAM policy and the SCP must explicitly allow it. An explicit deny in either the IAM policy or the SCP overrides any allow statement. SCPs define the maximum permissions available to accounts and OUs. IAM policies can only grant permissions within those boundaries.

Example scenario:

An IAM user has an IAM policy that allows full Amazon Simple Storage Service (Amazon S3) access. However, an SCP attached to the user's account denies all Amazon S3 actions. The user can't access Amazon S3 because the SCP denial overrides the IAM policy permission.

Related information

Identity and Access Management for AWS Organizations

Tutorial: Creating and configuring an organization

Terminology and concepts for AWS Organizations