SCP for AMI. Restriction

AWS offers a feature called "Allowed AMIs" that's specifically designed for controlling AMI usage across your organization. This is likely a better approach than using Service Control Policies (SCPs) for this particular use case.

Allowed AMIs is an account-wide setting that lets you limit which AMIs can be discovered and used within your AWS accounts. You can specify AMI owner accounts or owner aliases that are permitted, and only AMIs from these owners will be visible and available for launching EC2 instances.

Key benefits of using Allowed AMIs include:

1. Compliance and security: Users can only discover and use AMIs that meet your specified criteria, reducing the risk of non-compliant AMI usage.

2. Efficient management: By reducing the number of allowed AMIs, managing them becomes easier.

3. Centralized implementation: You can configure Allowed AMIs settings at the account level, either directly within the account or through a declarative policy.

You can apply this setting across AWS Organizations and Organizational Units using Declarative Policies, which allows you to manage and enforce this setting at scale. The feature also supports an audit mode to identify EC2 instances launched using AMIs not permitted by your settings before fully applying restrictions.

For controlling cross-account AMI sharing, you might still want to use SCPs or Resource Control Policies (RCPs) as complementary controls, but the Allowed AMIs feature would handle most of your requirements for restricting to approved AMIs only.

When deciding between policy types:

• Use declarative policies (like Allowed AMIs) for enforcing configuration settings
• Use SCPs when you need to restrict IAM principal permissions
• Use RCPs when you need to control access to your resources from external principals
  Sources
  Control the discovery and use of AMIs in Amazon EC2 with Allowed AMIs - Amazon Elastic Compute Cloud
  Enforcing enterprise-wide preventive controls with AWS Organizations | AWS Cloud Operations Blog
  Amazon EC2 introduces Allowed AMIs to enhance AMI governance - AWS