Does an SCP Deny on PurchaseCapacityBlock Prevent Member Accounts Under a Payer Account from Purchasing Capacity Blocks?

Question

![Enter image description here](/media/postImages/original/IMsUif4Z4CRKu2Q2qXYbZ5-A)

If we explicitly deny the PurchaseCapacityBlock action using an SCP, does this completely prevent member accounts under the payer account from purchasing Capacity Blocks, even if those member accounts have sufficient permissions at the IAM level?

In other words, does an SCP-level deny on Capacity Block purchases at the payer (management) account fully override any IAM allow policies within linked accounts?

Shahed Kazi (@shajam) · Accepted Answer

SCP applied to the management account may or may not override the permissions in the member account. It depends on where the permissions are added. The SCP works in a hierarchy - Root -> OU -> Account. Note, the root SCP will be in your management account but your management can contain other SCPs applied directly. Your child account will only inherit in the order specified.

Refer: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_evaluation.html

Jack · Answer

Yes, if you have a SCP Deny on PurchaseCapacityBlock it will prevent member accounts from purchasing capacity blocks. If a user or role has an IAM permission policy that grants access to an action that is either not allowed or explicitly denied by the applicable SCPs, the user or role can't perform that action. SCPs act as "permission guardrails" or a "permission ceiling" at the organization level, defining the maximum available permissions for all IAM users and roles in member accounts. An explicit deny always wins.
See https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

Does an SCP Deny on PurchaseCapacityBlock Prevent Member Accounts Under a Payer Account from Purchasing Capacity Blocks?

Add your answer

Relevant content