Question

A financial services company uses AWS Organizations with all features enabled. The security team wants to enforce that member accounts in the 'Production' OU can only use AWS services that have been formally approved through the company's internal risk assessment (currently 12 services). New services must never be usable until they pass review. Meanwhile, a separate 'Sandbox' OU should allow developers to experiment with any service except a small set of expensive or high-risk ones (e.g., specific EC2 instance families and certain database services). Which SCP strategy best meets both requirements with the least ongoing maintenance risk?

Accepted Answer

Apply an allow-list SCP (default deny with an explicit list of approved service actions) to the Production OU, and a deny-list SCP (allow all except explicitly denied actions) to the Sandbox OU.

Answer

Apply a deny-list SCP to both OUs, explicitly denying every unapproved service in Production and the high-risk services in Sandbox.

Answer

Apply an allow-list SCP to both OUs, listing the 12 approved services for Production and enumerating every allowed service for Sandbox.

Answer

Rely on IAM permission boundaries in each member account to allow only approved services in Production, and use an SCP only on the Sandbox OU.