Organizations, SCPs and AWS Config

What it is

Larger AWS environments use many accounts to separate workloads, teams and environments. AWS Organizations groups those accounts, applies central policies, and gives consolidated billing.

AWS Config answers a different question: what is the configuration of my resources, and does it match the rules I set? Together they let you set guardrails and prove compliance.

How it works

Organizations structure

An organization has one management account and any number of member accounts. Accounts sit in organizational units (OUs), which can be nested. Policies attached to an OU apply to every account below it.

Using separate accounts limits the effect of a mistake or compromise, and makes cost and access boundaries clearer. AWS Control Tower can build a multi account landing zone with preconfigured controls, and it uses Organizations underneath.

Service control policies

An SCP is a guardrail that sets the maximum permissions for accounts. The effective permissions of a principal are the overlap of the SCP and the principal's own IAM policies.

• SCPs affect IAM users and roles in member accounts, including the root user of a member account.
• SCPs do not affect the management account.
• SCPs never grant permission by themselves.
• Two common styles: a deny list that blocks specific actions and allows the rest, or an allow list that allows only named services.

A typical guardrail denies use of Regions you do not approve.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "NotAction": ["iam:*", "organizations:*", "sts:*", "support:*"],
    "Resource": "*",
    "Condition": {
      "StringNotEquals": { "aws:RequestedRegion": ["eu-west-1", "eu-central-1"] }
    }
  }]
}

Other policy types in Organizations include tag policies, backup policies and AI services opt out policies. Tag policies define the keys and values you allow.

AWS Config

AWS Config records the configuration of supported resources as configuration items and keeps a history of changes. Config needs a configuration recorder and a delivery channel, which writes history to an S3 bucket.

A Config rule is either AWS managed (for example, checks that S3 buckets block public access or that volumes are encrypted) or custom, using a Lambda function or Guard. Rules run when a resource changes, or on a periodic schedule, depending on the rule.

# AWS CLI: list non compliant resources for a rule
aws configservice get-compliance-details-by-config-rule \
  --config-rule-name s3-bucket-public-read-prohibited \
  --compliance-types NON_COMPLIANT

Remediation can be manual, or automatic with retries. For example, an unencrypted volume can trigger a runbook that creates an encrypted copy, or a public bucket can be locked down at once.

Config, CloudTrail and CloudWatch compared

Central security view

In an organization, you can name a delegated administrator account for services such as Config, GuardDuty and Security Hub. This keeps security tooling out of the management account and gives one place to see all accounts.