Skip to main content

SCP Management

Service Control Policies (SCPs) are the strongest enforcement mechanism in AWS Organisations. Guardian Pro helps you deploy, monitor, and manage SCPs across six security categories -- ensuring your guardrails are comprehensive and consistent.

Prerequisites​

SCP management requires:

  • An AWS Organisation with a management account connected to Guardian Pro.
  • The connected IAM role must have permissions to read and manage SCPs.
  • governance:write permission in Guardian Pro.
info

SCP management is not available for single-account setups. If you are using Guardian Pro with a single account, the guardrails section will not appear. Connect your management account to enable this feature.

Guardrail Categories​

Guardian Pro organises SCPs into six security categories. Each category represents a class of preventive control:

CategoryPurpose
Region RestrictionRestrict API calls to approved AWS regions
Privileged Access ControlBlock root user activity and restrict privileged access
Protect Security ServicesPrevent disabling CloudTrail, Config, GuardDuty, and other security services
Data PerimeterEnforce encryption and block public access to data stores
Protect Platform ResourcesPrevent accounts from leaving the organisation or modifying platform-level resources
Approved ServicesRestrict which AWS services can be used within the organisation

Coverage Overview​

The guardrails section opens with a coverage bar showing your overall guardrail posture:

  • Coverage percentage -- Weighted score across all six categories.
  • Colour-coded bar -- Green segments for categories covered organisation-wide, yellow for partially covered categories.
  • Breakdown -- Number of categories with organisation-wide coverage, partial coverage, and gaps.

Category Cards​

Each of the six categories is displayed as a colour-coded card:

  • Green -- Covered organisation-wide. Shows the matching policy name and confirms it is applied at root.
  • Yellow -- Partially covered. Shows which OUs or accounts are covered and warns that not all accounts are protected.
  • Red -- Gap. No matching SCP is deployed for this category.

Deploying Guardrails​

For categories with gaps or partial coverage, Guardian Pro provides pre-built SCP templates that you can deploy directly.

Template Library​

Each template card shows:

  • Template name and description.
  • Risk level badge (Low, Medium, or High) indicating the operational impact of the policy.
  • Whether the template is configurable (has parameters you can customise).
  • A preview of the SCP JSON.

Deployment Flow​

  1. Find the category you want to cover and click Deploy on a template.
  2. Configure parameters (for parameterised templates):
    • Region Restriction -- Select which AWS regions to allow.
    • Privileged Access Control -- Specify admin role ARNs to exempt.
    • Approved Services -- Choose which AWS service namespaces to permit.
  3. Preview the generated SCP JSON before deploying.
  4. Select targets -- Choose which OUs or accounts to apply the policy to. Select root for organisation-wide coverage.
  5. Click Deploy.
caution

SCPs are powerful -- they deny actions for all principals in the target accounts, including administrators. Always review the generated policy carefully and consider deploying to a test OU before applying organisation-wide.

Generating SCPs from Tag Policies​

Guardian Pro can generate tag enforcement SCPs from your existing tag policies. This creates an SCP that blocks resource creation when required tags are missing -- enforcing your tagging standards at the AWS level rather than detecting violations after the fact.

Approved Services SCP​

The approved services template generates an SCP that restricts which AWS services can be used. You provide a list of approved service namespaces, and the generated policy denies all other services. Mandatory exemptions (e.g., IAM, STS, Organisations) are included automatically to avoid locking out essential functionality.

Drift Detection​

When a Guardian Pro-managed SCP is modified or deleted outside of Guardian Pro (e.g., directly in the AWS console or by another tool), Guardian Pro detects the drift and displays a warning on the affected category card.

The drift warning shows:

  • The policy name that has drifted.
  • A Redeploy button to restore the original policy.
tip

Check for drift regularly, especially if multiple tools or teams manage your AWS Organisation. Drift can silently weaken your guardrail coverage.

Policy Inventory​

The All Deployed Policies section lists every SCP and RCP in your organisation, regardless of whether Guardian Pro manages them. Each policy shows:

  • Policy name and ID.
  • Source -- AWS Managed, Guardian (deployed by Guardian Pro), Control Tower, or External.
  • Target count -- How many OUs or accounts the policy is attached to.
  • Detected categories -- Which of the six security categories the policy covers.

Modifying Policies​

Click Modify on any Guardian-managed policy to:

  • Edit the policy name, description, or JSON content.
  • Delete the policy (with confirmation).

Managing Targets​

Click Targets on any policy to open the target management dialog. This shows an OU tree view where you can attach or detach the policy from specific OUs and accounts.

Organisation Sync​

The guardrails section shows your organisation summary: OU count, account count, and last sync time. Click Sync to refresh the OU hierarchy from your AWS Organisation. This ensures Guardian Pro has an up-to-date view of your structure for target selection and coverage calculation.

Next Steps​