Glossary
Service control policy (SCP)
An AWS Organizations policy that caps the maximum permissions of member accounts — used in incidents to deny unused regions or protect logging.
A service control policy (SCP) is an AWS Organizations policy attached to the organization root, an organizational unit or an account. It does not grant permissions: it sets the maximum that IAM policies in member accounts can allow, and it also applies to their root users. SCPs do not affect the management account.
In incident response, SCPs are a containment and hardening tool: deny all
actions in regions you do not use (a favourite hiding place for
crypto-mining), deny
cloudtrail:StopLogging or guardduty:DeleteDetector to everyone but a
break-glass role, or block calls from an attacker's address with an
aws:SourceIp condition while you investigate.
Reference: Service control policies.