Four controls that look similar and do different jobs. SCPs cap what your principals can do, RCPs cap what can be done to your resources by anyone, declarative policies pin service settings, and centralized root access removes root credentials from member accounts. Which to use for what.
Until late 2024, service control policies were the only organization-wide guardrail. AWS then added resource control policies and centralized root access in November 2024 and declarative policies in December. Each closes a gap the others cannot.
An SCP cannot stop a principal in someone else's account. If a developer writes a bucket policy that grants access to an external account, no SCP in your organization applies to that external principal. An RCP does: it sets the maximum permissions on your resources whoever the caller is. The standard pattern denies access to S3, KMS, STS, SQS and Secrets Manager unless aws:PrincipalOrgID is yours, with exceptions for AWS service principals and named partners.
RCPs launched for those five services and have expanded since, including Cognito and CloudWatch Logs in January 2026 and DynamoDB in February. Control Tower manages RCPs only for the original five; for the rest, you write and maintain your own.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
An SCP denies API calls. When a service adds a new API that changes the same setting, the SCP does not cover it until someone updates the policy. A declarative policy sets the configuration itself, at the service, so it holds regardless of which API is called and for accounts added later. They cover EC2, EBS and VPC settings, and you can show a custom error message that tells people why a call was blocked and whom to ask.
Every AWS account has a root user, and in a large organization that means hundreds of root passwords and MFA devices to protect. With centralized root access enabled, you can delete root credentials from member accounts and perform the few root-only tasks (unlocking a misconfigured bucket policy, for example) from the management account or a delegated administrator, through short-lived sessions. New accounts can be created without root credentials at all.
Enable centralized root access and remove member-account root credentials. Lowest risk, highest value.
Apply declarative policies for public sharing and IMDSv2. They rarely break anything that should exist.
Apply SCPs for Regions and for protecting your logging and security tooling.
Roll out RCPs last and slowly. They can break legitimate cross-account and third-party access. Start in audit by reviewing CloudTrail and IAM Access Analyzer findings for external access, then apply to a sandbox OU before production.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
AWS Control Tower in 2026: Landing Zone 4.0, Controls-Only Mode and How to Set It Up
Landing zone 4.0 made almost everything in Control Tower optional: Config, CloudTrail, security roles, Backup, even the Security OU. You can now use its 750-plus managed controls without a landing zone at all. What changed, what to enable, and when Control Tower is the wrong tool.
Read
AWS Spend Limits: The Limitations, and What to Do About Each
Spend limits only work on projects created through the new AWS signup experience, can't cover an existing account or an organization, can't spare production while stopping the rest, and pause everything at once. Each limitation, what it means in practice, and the workaround until AWS extends the feature.
Read
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.