AWS Organizations SCP Pack

10 SCPs Ready to Attach

Service Control Policies are one of the most effective security controls in AWS — and one of the most skipped because writing them correctly is tedious. This pack gives you 10 battle-tested SCPs covering the highest-impact guardrails, ready to review and attach.

Included SCPs

1. Deny Non-Approved Regions — restrict all API calls outside your approved region list
2. Require MFA for Root — block all root actions without MFA
3. Deny Public S3 Buckets — prevent any bucket from having a public ACL or policy
4. Deny Unencrypted EBS Volumes — require encryption at rest for all new volumes
5. Deny Unencrypted RDS Instances — block unencrypted database creation
6. Deny Public RDS Snapshots — prevent snapshot sharing with all AWS accounts
7. Deny IAM Access Key Creation for Root — harden root account hygiene
8. Require S3 Secure Transport — deny HTTP bucket access, HTTPS only
9. Deny CloudTrail Modifications — prevent disabling or deleting audit trails
10. Deny Unused Services — configurable blocklist of services not approved for use

Included Files

• scps/ — 10 individual JSON SCP documents
• attach-scps.sh — script to attach to specific OUs via CLI
• test-scps.sh — validation script to verify SCPs are in effect
• README.md — OU attachment recommendations and testing guide