> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Setting Up SCPs and OUs With AWS Organizations

> Guide to creating AWS Organization OUs and Service Control Policies to centrally prevent S3 bucket deletion by attaching an explicit Deny policy to a Development OU.

This lesson walks through creating Organizational Units (OUs) and Service Control Policies (SCPs) in AWS Organizations to enforce account-wide governance. SCPs provide organizational guardrails by restricting permissions across member accounts, while OUs are containers used to group accounts (for example, Development, Production, Security) so policies can be applied consistently.

What you'll do:

* Create an OU (Development)
* Author an SCP to Deny S3 bucket deletion
* Attach the SCP to the OU so it applies to all member accounts

## Navigate to AWS Organizations

1. Sign in to the AWS Management Console and open AWS Organizations.
2. If this is your first time, select the AWS Accounts panel. Otherwise, you’ll land on the Accounts view.
3. At the top of the hierarchy is the Root. You can create Organizational Units directly under Root and move accounts into them.

Select the Root and choose to create a new Organizational Unit. Give it a descriptive name such as `Development` (common OU names: Development, Production, Security).

![Browser screenshot of the AWS Organizations "Create organizational unit" page with the Organizational unit name filled as "Development" and a Tags section shown below.](https://mintcdn.com/kodekloud-c4ac6d9a/FCC3Du5gLxWM9z2p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/Demo-Setting-Up-SCPs-and-OUs-With-AWS-Organizations/aws-organizations-create-ou-development-tags.jpg?fit=max\&auto=format\&n=FCC3Du5gLxWM9z2p\&q=85\&s=ce6b3432bacd581e610228915699dec1)

Scroll down and create the OU. Once created, you’ll see it in the organization tree under Root.

![A screenshot of the AWS Organizations console showing the Root view with a "Children" list of organizational units (Development, Sandbox, Security) and an Actions menu. The browser header shows the CloudWithDjango-Org account.](https://mintcdn.com/kodekloud-c4ac6d9a/FCC3Du5gLxWM9z2p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/Demo-Setting-Up-SCPs-and-OUs-With-AWS-Organizations/aws-organizations-root-children-list.jpg?fit=max\&auto=format\&n=FCC3Du5gLxWM9z2p\&q=85\&s=4d3dddabc3f15fd8c08ce6f668aea5c8)

## Create a Service Control Policy (SCP)

SCPs are JSON documents that set the maximum available permissions for accounts in the organization or OU. They do not grant permissions — they only restrict them. To create an SCP:

1. In the left navigation panel, expand Policies and open the Policies tab.
2. Ensure Service control policies are enabled for your organization.
3. Choose Create policy.

![A screenshot of the AWS Organizations "Service control policies" console. It shows available policies (e.g., FullAWSAccess) and buttons to create a policy or disable service control policies.](https://mintcdn.com/kodekloud-c4ac6d9a/FCC3Du5gLxWM9z2p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/Demo-Setting-Up-SCPs-and-OUs-With-AWS-Organizations/aws-organizations-service-control-policies-console.jpg?fit=max\&auto=format\&n=FCC3Du5gLxWM9z2p\&q=85\&s=c0166fd519943c16bbcd163d54ad9727)

For this demo, create a policy named `DenyS3Delete` (or `Deny S3 delete`) that explicitly denies the S3 DeleteBucket action across all resources. In the policy editor, paste the following JSON:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyS3Delete",
      "Effect": "Deny",
      "Action": [
        "s3:DeleteBucket"
      ],
      "Resource": "*"
    }
  ]
}
```

Key points about this policy:

* `Effect: "Deny"` — any request that attempts to delete an S3 bucket will be blocked.
* `Action: "s3:DeleteBucket"` — targets the S3 DeleteBucket API operation.
* `Resource: "*"` — the denial applies to all buckets in the affected accounts.

Create the policy in the console after entering the JSON.

SCPs are powerful: an explicit Deny overrides allow permissions even if an IAM policy grants them. Test SCPs on a limited set of accounts before applying them broadly.

## Attach the SCP to the OU

After creating the SCP, attach it to the OU to enforce the restriction across member accounts.

Steps to attach:

1. Open the `Development` OU in the Organizations console.
2. Scroll to the Policies section and choose Attach.
3. Select the `DenyS3Delete` policy and attach it.

The console will confirm the policy was successfully attached to the OU.

```text theme={null}
arn:aws:organizations::635573991785:ou/o-tntxomtx8t/ou-pa0h-rrzm8vnr

Organization path:
o-tntxomtx8t/r-pa0h/ou-pa0h-rrzm8vnr/
```

![A screenshot of the AWS Organizations console showing the "Development" organizational unit page with a green success banner that reads "You successfully attached the policy 'DenyS3Delete' to this resource." The page also shows action buttons like Delete and Rename and organizational unit details text.](https://mintcdn.com/kodekloud-c4ac6d9a/FCC3Du5gLxWM9z2p/images/AWS-Certified-DevOps-Engineer-Professional/Domain-6-Security-and-Compliance/Demo-Setting-Up-SCPs-and-OUs-With-AWS-Organizations/aws-organizations-development-policy-denys3delete-success.jpg?fit=max\&auto=format\&n=FCC3Du5gLxWM9z2p\&q=85\&s=b9ccee51736cf0bf0ae82b65b31012f5)

By attaching the policy to the OU, the guardrail applies to all member accounts within that OU. This approach scales governance without requiring individual account configuration.

SCPs do not grant permissions. They act as a permissions boundary: IAM policies still grant access, but SCPs further restrict which permissions can be used. SCPs apply to all IAM principals (users and roles) in the accounts to which the SCP is attached; attaching at the Root affects all organization accounts, including the management account.

## Quick Reference

| Topic | Purpose | Example/Notes |
| - | - | - |
| Organizational Unit (OU) | Group accounts for centralized governance | Common names: `Development`, `Production`, `Security` |
| Service Control Policy (SCP) | Enforce permission guardrails across accounts | Use explicit Deny to block actions like `s3:DeleteBucket` |
| Policy attachment | Apply SCP to an OU to affect all member accounts | Attach via Organizations > OU > Policies > Attach |
| IAM policies | Grant permissions within an account | SCPs only restrict; IAM still required to grant access |

## Links and further reading

* AWS Organizations overview: [https://docs.aws.amazon.com/organizations/latest/userguide/orgs\_introduction.html](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html)
* Service control policies (SCPs): [https://docs.aws.amazon.com/organizations/latest/userguide/orgs\_manage\_policies\_scps.html](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html)
* IAM policies and permissions: [https://docs.aws.amazon.com/IAM/latest/UserGuide/access\_policies.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html)

## Key takeaways

* AWS Organizations enables centralized management of multiple AWS accounts.
* Use Organizational Units (OUs) to group accounts and apply consistent governance.
* Service Control Policies (SCPs) set organization-level guardrails; they restrict permissions but do not grant them.
* Always test SCPs carefully, since explicit denies are enforced across all IAM principals in affected accounts.

This lesson demonstrated creating an OU (Development), authoring an SCP to deny S3 bucket deletion, and attaching the SCP to the OU so the restriction is enforced across member accounts.

> **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/d51f4260-d612-4dcb-9a91-4eeb6540c6c7/lesson/44b63661-b3cd-4432-a22a-84731d4442de)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.