SCP not matching implicit Deny

Question

I have an Org with a few OUs and an "S3 only" account living in one of the OUs.  I attached an SCP to the account that essentially says "allow S3" and nothing else.  Isn't there supposed to be implicit deny on an SCP?  With this attached, I seem to have Full Access.  With an explicit deny in the SCP, I cannot access anything, including S3.  Any advice on what I may be missing?  Thank you.

Leo K · Accepted Answer

All the SCPs attached to each individual level of the organisation hierarchy (including the last level that is the individual account) are evaluated together. For example, if you have both the FullAWSAccess and your S3-only SCP attached to the OU level where you're hoping only S3 permissions to apply, the "Allow" statements in both those two SCPs will be combined, causing everything to be allowed.

If you specifically want an implicit deny to block actions other than s3:*, you should ensure there's one level of hierarchy where only the S3-only allow policy is attached. The appropriate level in your case would probably be the individual account that only contains S3 resources.

One alternative would be to write an explicit Deny statement with a `NotAction` element containing `s3:*`.

Steve_M · Answer

What you're missing is that the policy **FullAWSAccess** is applied to the account by default, and so what you're describing is correct behaviour.

This is fully explained about halfway down https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_evaluation.html

> AWS Organizations attaches an AWS managed SCP named **FullAWSAccess** to every root, OU and account when it's created. This policy allows all services and actions. You can replace **FullAWSAccess** with a policy allowing only a set of services so that new AWS services are not allowed unless they are explicitly allowed by updating SCPs.

Further down the page it walks you through a scenario that is very similar to what you're looking to achieve (allowing only access to specific service(s) and denying everything else), by replacing **FullAWSAccess** with a bespoke policy.

Troy · Answer

Thank you both!  I was missing the fact the default SCP was still applied to the account.  I thought it would be replaced with a new attachment.

SCP not matching implicit Deny

Add your answer

Relevant content