Who is not limited by SCPs?

Correct: b. Official Organizations SCP guide.

Where does pay-api’s account go?

Correct: b. Landing zone first.

Best tool to stop a member account from leaving the org?

Correct: b. Preventive guardrail.

Amazon · AWS security · Lesson 2 of 10

Landing zone: OUs and SCPs before the first workload

Someone built pay-api in the management account because “it was already there.” Now an SCP cannot save you — SCPs do not apply to the management account. Organizations + OUs + SCPs + Control Tower land first. An SCP is a guardrail (deny). It never grants a permission.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Put Security and Workloads in separate OUs before the first app VPC.
Explain that an SCP filters maximum permission — it does not grant.
Keep workloads out of the management account.
Prove the OU attach and the deny with organizations CLI.

The ticket

Junior enabled a second region and turned off the CloudTrail trail in the same account that pays the org bill. You cannot SCP the management account. The landing zone was a slide, not a build.

Quick interview answer

AWS Organizations is the multi-account container. OUs (this lab: Security, Workloads) are where you attach policy. A service control policy (SCP) sets the maximum permissions for IAM users and roles in member accounts — including that account’s root. SCPs do not grant. Identity policies still have to allow. Default managed SCP is FullAWSAccess (allow *). Control Tower vends the landing zone (org, log-archive / audit-style accounts, baseline guardrails, Account Factory). Build that before hub VPC 10.50.0.0/16 and app VPC 10.51.0.0/16.

AWS Organization with Security and Workloads OUs above any VPC — The VPC is a child of the account. The account is a child of the OU.

Lab data · dummy only

Account 111122223333 · OUs Security / Workloads · hub VPC 10.50.0.0/16 · app VPC 10.51.0.0/16 · SG sg-web · NACL acl-app · bucket tc-lab-app-logs · role AppEC2Role · TGW tgw-lab · VGW public 203.0.113.60 · on-prem FortiGate WAN 203.0.113.10. Dummy account ID. Not yours.

Mental model

Object	Job	This lab
Organization	One bill, one tree, org trail later	mgmt + member accounts under 111122223333 as the dummy id you type
OU Security	Log archive, audit, security tooling	No pay-api here
OU Workloads	App accounts, hub/app VPCs	10.50.0.0/16 · 10.51.0.0/16
SCP	Deny / allow-list ceiling	Deny leave-org, deny disable-trail, deny unapproved regions

SCP is a filter

No SCP statement ever gives Priya s3:*. It can only stop her.

https://111122223333.signin.aws.amazon.com/console

Training mock · not live

AWS console

VPCIAMS3CloudTrail

Organizations → Organize accounts

Root → Security / Workloads

Management account

Not limited by SCPs — do not run pay-api here

OU Security

Log archive / audit · preventive + detective guardrails

OU Workloads

App account · hub 10.50.0.0/16 app 10.51.0.0/16

SCP on Workloads

Deny: leave org, disable trail, unapproved regions

Control Tower

Landing zone + Account Factory — before first workload

SCP is a guardrail. Control Tower first. Training mock.

How to choose

Need	Use	Do not
Stop member root from disabling CloudTrail	SCP deny on the OU	Trust an IAM policy alone
Give Priya S3 read	Identity Center permission set / IAM policy	An SCP Allow thinking it grants
New app account	Control Tower Account Factory into Workloads	Build in management

Runbook

Side A — tree
Organizations: root → OU Security, OU Workloads. Member workload account under Workloads. Nothing runnable in management except org admin.
Side B — guardrail
Attach SCPs to Workloads. Keep FullAWSAccess unless you are moving to an allow-list model on purpose. Test the deny in a sandbox account first.
Side C — prove
From the member account, attempt a denied action. Expect explicit deny. From management, remember SCPs did not apply — that is why workloads do not live there.

aws cli · org proof

aws organizations list-roots
# Id: r-lab1

aws organizations list-organizational-units-for-parent --parent-id r-lab1
# Security    Workloads

aws organizations list-policies --filter SERVICE_CONTROL_POLICY
# FullAWSAccess (AWS managed)   p-deny-leave (customer)

aws organizations list-policies-for-target --target-id ou-lab-workloads --filter SERVICE_CONTROL_POLICY
# p-deny-leave attached

Four failures

1 · Workload in the management account

SCPs will not constrain it. Billing + blast radius share a login.

2 · “I attached an SCP Allow so she has access”

She does not. SCP is not a grant. Check the permission set.

3 · SCP on the account, app already using a denied region

You just broke prod. Attach to a sandbox OU, then move the account.

4 · Control Tower after 40 accounts

You will spend a quarter cleaning what Account Factory would have vended clean.

How to prove it

Close only when

1) Workloads sit in the Workloads OU. 2) You can name the SCP and that it does not grant. 3) Management is empty of apps. 4) A denied API in the member account fails for root too.

Traps

Belief	Docs
SCP replaces IAM	Both must allow; SCP is the ceiling
Member root bypasses SCP	Member root is in scope
Management root is in scope	SCPs do not affect the management account

AWS security class series: Shared + IAM · Org / OU · SG vs NACL · Role not key · KMS + Secrets · VPC endpoint · Trail + GuardDuty · TGW hub · S3 public · Interview

Sources

AWS Organizations — Service control policies (SCPs).