# Landing zone: OUs and SCPs before the first workload Source: https://ai.techclick.in/blog_aws_org_ou_control_tower Markdown: https://ai.techclick.in/blog_aws_org_ou_control_tower.md Publisher: Techclick Infosec Pvt Ltd Organizations + OUs + SCPs + Control Tower landing zone before workloads. SCP is a deny guardrail, not a grant. ## The ticket Junior enabled a second region and turned off the CloudTrail trail in the same account that pays the org bill. You cannot SCP the management account. The landing zone was a slide, not a build. Quick interview answer AWS Organizations is the multi-account container. OUs (this lab: Security, Workloads) are where you attach policy. A service control policy (SCP) sets the maximum permissions for IAM users and roles in member accounts — including that account’s root. SCPs do not grant . Identity policies still have to allow. Default managed SCP is FullAWSAccess (allow *). Control Tower vends the landing zone (org, log-archive / audit-style accounts, baseline guardrails, Account Factory). Build that before hub VPC 10.50.0.0/16 and app VPC 10.51.0.0/16 . Hero · OUs before apps The VPC is a child of the account. The account is a child of the OU. Lab data · dummy only Account 111122223333 · OUs Security / Workloads · hub VPC 10.50.0.0/16 · app VPC 10.51.0.0/16 · SG sg-web · NACL acl-app · bucket tc-lab-app-logs · role AppEC2Role · TGW tgw-lab · VGW public 203.0.113.60 · on-prem FortiGate WAN 203.0.113.10 . Dummy account ID. Not yours. ## Mental model Object Job This lab Organization One bill, one tree, org trail later mgmt + member accounts under 111122223333 as the dummy id you type OU Security Log archive, audit, security tooling No pay-api here OU Workloads App accounts, hub/app VPCs 10.50.0.0/16 · 10.51.0.0/16 SCP Deny / allow-list ceiling Deny leave-org, deny disable-trail, deny unapproved regions SCP is a filter IAM allow - SCP ceiling API happens SCP deny wins No SCP statement ever gives Priya s3:*. It can only stop her. https://111122223333.signin.aws.amazon.com/console Training mock · not live AWS console VPC IAM S3 CloudTrail Organizations → Organize accounts ### Root → Security / Workloads Management account Not limited by SCPs — do not run pay-api here OU Security Log archive / audit · preventive + detective guardrails OU Workloads App account · hub 10.50.0.0/16 app 10.51.0.0/16 SCP on Workloads Deny: leave org, disable trail, unapproved regions Control Tower Landing zone + Account Factory — before first workload Cancel Save SCP is a guardrail. Control Tower first. Training mock. ## How to choose Need Use Do not Stop member root from disabling CloudTrail SCP deny on the OU Trust an IAM policy alone Give Priya S3 read Identity Center permission set / IAM policy An SCP Allow thinking it grants New app account Control Tower Account Factory into Workloads Build in management ## Runbook #### Side A — tree Organizations: root → OU Security, OU Workloads. Member workload account under Workloads. Nothing runnable in management except org admin. - #### Side B — guardrail Attach SCPs to Workloads. Keep FullAWSAccess unless you are moving to an allow-list model on purpose. Test the deny in a sandbox account first. - #### Side C — prove From the member account, attempt a denied action. Expect explicit deny. From management, remember SCPs did not apply — that is why workloads do not live there. aws cli · org proof aws organizations list-roots # Id: r-lab1 aws organizations list-organizational-units-for-parent --parent-id r-lab1 # Security Workloads aws organizations list-policies --filter SERVICE_CONTROL_POLICY # FullAWSAccess (AWS managed) p-deny-leave (customer) aws organizations list-policies-for-target --target-id ou-lab-workloads --filter SERVICE_CONTROL_POLICY # p-deny-leave attached ## Four failures ### 1 · Workload in the management account SCPs will not constrain it. Billing + blast radius share a login. ### 2 · “I attached an SCP Allow so she has access” She does not. SCP is not a grant. Check the permission set. ### 3 · SCP on the account, app already using a denied region You just broke prod. Attach to a sandbox OU, then move the account. ### 4 · Control Tower after 40 accounts You will spend a quarter cleaning what Account Factory would have vended clean. ## How to prove it Close only when 1) Workloads sit in the Workloads OU. 2) You can name the SCP and that it does not grant. 3) Management is empty of apps. 4) A denied API in the member account fails for root too. ## Traps Belief Docs SCP replaces IAM Both must allow; SCP is the ceiling Member root bypasses SCP Member root is in scope Management root is in scope SCPs do not affect the management account ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 An SCP Allow * on the Workloads OU means Priya can do everything? Yes — SCP grants No — SCP does not grant; identity policy must also allow Only for S3 Only for root Correct: b . SCP is a ceiling. Q2 Who is not limited by SCPs? Member account root The management account AppEC2Role in a member account Every IAM user Correct: b . Official Organizations SCP guide. Q3 Where does pay-api’s account go? Management account OU Workloads, after the landing zone exists Inside the TGW object As a bucket policy Correct: b . Landing zone first. Q4 Best tool to stop a member account from leaving the org? A friendly email SCP deny on organizations:LeaveOrganization Delete IAM Open sg-web Correct: b . Preventive guardrail. Q5 Control Tower’s job in this series is… Replace IAM Identity Center Vend the landing zone and account baseline before workloads Terminate the VPN Encrypt EBS by itself Correct: b . Landing zone. Q6 Default AWS managed SCP on a new org? Deny all FullAWSAccess (allow *) — a ceiling, still not a grant to a user An S3 ACL A TGW route Correct: b . FullAWSAccess. Check answers Reset AWS security class series: Shared + IAM · Org / OU · SG vs NACL · Role not key · KMS + Secrets · VPC endpoint · Trail + GuardDuty · TGW hub · S3 public · Interview ## Sources - AWS Organizations — Service control policies (SCPs) . Related: AWS session factory · Migration series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt