Skip to main content
This lesson walks through creating Organizational Units (OUs) and Service Control Policies (SCPs) in AWS Organizations to enforce account-wide governance. SCPs provide organizational guardrails by restricting permissions across member accounts, while OUs are containers used to group accounts (for example, Development, Production, Security) so policies can be applied consistently. What you’ll do:
  • Create an OU (Development)
  • Author an SCP to Deny S3 bucket deletion
  • Attach the SCP to the OU so it applies to all member accounts
  1. Sign in to the AWS Management Console and open AWS Organizations.
  2. If this is your first time, select the AWS Accounts panel. Otherwise, you’ll land on the Accounts view.
  3. At the top of the hierarchy is the Root. You can create Organizational Units directly under Root and move accounts into them.
Select the Root and choose to create a new Organizational Unit. Give it a descriptive name such as Development (common OU names: Development, Production, Security).
Browser screenshot of the AWS Organizations "Create organizational unit" page with the Organizational unit name filled as "Development" and a Tags section shown below.
Scroll down and create the OU. Once created, you’ll see it in the organization tree under Root.
A screenshot of the AWS Organizations console showing the Root view with a "Children" list of organizational units (Development, Sandbox, Security) and an Actions menu. The browser header shows the CloudWithDjango-Org account.

​
Create a Service Control Policy (SCP)

SCPs are JSON documents that set the maximum available permissions for accounts in the organization or OU. They do not grant permissions — they only restrict them. To create an SCP:
  1. In the left navigation panel, expand Policies and open the Policies tab.
  2. Ensure Service control policies are enabled for your organization.
  3. Choose Create policy.
A screenshot of the AWS Organizations "Service control policies" console. It shows available policies (e.g., FullAWSAccess) and buttons to create a policy or disable service control policies.
For this demo, create a policy named DenyS3Delete (or Deny S3 delete) that explicitly denies the S3 DeleteBucket action across all resources. In the policy editor, paste the following JSON:
Key points about this policy:
  • Effect: "Deny" — any request that attempts to delete an S3 bucket will be blocked.
  • Action: "s3:DeleteBucket" — targets the S3 DeleteBucket API operation.
  • Resource: "*" — the denial applies to all buckets in the affected accounts.
Create the policy in the console after entering the JSON.
SCPs are powerful: an explicit Deny overrides allow permissions even if an IAM policy grants them. Test SCPs on a limited set of accounts before applying them broadly.

​
Attach the SCP to the OU

After creating the SCP, attach it to the OU to enforce the restriction across member accounts. Steps to attach:
  1. Open the Development OU in the Organizations console.
  2. Scroll to the Policies section and choose Attach.
  3. Select the DenyS3Delete policy and attach it.
The console will confirm the policy was successfully attached to the OU.
A screenshot of the AWS Organizations console showing the "Development" organizational unit page with a green success banner that reads "You successfully attached the policy 'DenyS3Delete' to this resource." The page also shows action buttons like Delete and Rename and organizational unit details text.
By attaching the policy to the OU, the guardrail applies to all member accounts within that OU. This approach scales governance without requiring individual account configuration.
SCPs do not grant permissions. They act as a permissions boundary: IAM policies still grant access, but SCPs further restrict which permissions can be used. SCPs apply to all IAM principals (users and roles) in the accounts to which the SCP is attached; attaching at the Root affects all organization accounts, including the management account.

​
Quick Reference

​
Key takeaways

  • AWS Organizations enables centralized management of multiple AWS accounts.
  • Use Organizational Units (OUs) to group accounts and apply consistent governance.
  • Service Control Policies (SCPs) set organization-level guardrails; they restrict permissions but do not grant them.
  • Always test SCPs carefully, since explicit denies are enforced across all IAM principals in affected accounts.
This lesson demonstrated creating an OU (Development), authoring an SCP to deny S3 bucket deletion, and attaching the SCP to the OU so the restriction is enforced across member accounts.

Watch Video