// the find
aws-samples/service-control-policy-examples
Example AWS Service control policies to get started or mature your usage of AWS SCPs.
A collection of ready-to-use AWS Service Control Policy JSON files covering common org-level guardrails: region locking, root user restrictions, security service protection, and data perimeter controls. Aimed at AWS platform engineers building out multi-account Organizations structures who want a starting point rather than writing IAM deny policies from scratch.
The category structure maps directly to real security program requirements (data perimeter, privilege controls, sensitive data), so you can go straight to what your compliance team asked for. The 'top SCPs to get started' section gives a sensible on-ramp — root user denial and org-leave prevention are the two that bite teams most early on. Recent additions like Bedrock model invocation restrictions and Q Developer controls track current AWS service sprawl. The repo is still getting commits in 2026, which matters for a policy library since AWS keeps adding services that need coverage.
These are static JSON files with no tooling to deploy, test, or diff them against your live org — you're on your own with that. There's no guidance on the interaction between these SCPs and resource control policies (RCPs), which AWS added in late 2023 and which change the evaluation model. Several policies use broad service-level denies (e.g. `config:*`) which will break automated ops tooling in ways that aren't obvious until something stops working in prod. No test coverage or simulation output included, which contradicts the README's own advice to test thoroughly before attaching.