-
Book Overview & Buying
-
Table Of Contents
AWS for System Administrators - Second Edition
By :
So far, we have only dealt with a single AWS account and a single user to which we attached the rights to carry out API operations via IAM policies. However, we quite often have the use case for more than one AWS account. Think about a typical development project. Here, we’d usually want to have a separate account for production and testing and maybe even a third for development.
As the number of accounts grows, it makes sense to ensure that even the admins of these accounts can’t do everything in the account. We want to enforce certain guardrails and define upper limits for what kind of API actions can be allowed by IAM policies. This is done by applying Service Control Policies – or SCPs for short. SCPs are a powerful concept to prevent even admin users from carrying out certain API actions.
But sometimes, we don’t want to outright deny an action or configuration but just want to be informed about it...