How SCPs Combine with IAM Policies
~8 min read
The two-layer evaluation model: SCPs set the ceiling, IAM policies grant within that ceiling.
How SCPs Combine with IAM Policies is a Pro topic
Sign in, then upgrade to Pro or Power to unlock this topic and the full AWS curriculum.
Key points
- •Two-layer evaluation: SCPs (ceiling, org-wide) evaluated first, then the account's own IAM policies (grant, within that ceiling)
- •An SCP denial blocks the action regardless of what IAM policies would otherwise allow
- •SCPs never grant permission on their own — an allowing SCP only makes it POSSIBLE for IAM to grant that access
- •Common pattern: permissive baseline at the root, specific restrictive SCPs attached to OUs that need them