Guided Walkthroughs
Step-by-step configuration wizards for your environment
Dedicated Security Account
AWS Backup Strategy
VPC Connectivity Setup
Automated Patching
All Guides
AI CloudAdvisor (Beta)
Configuration Stack0
My Presets
Security Controls
Service Control Policies
Config Rules
CloudWatch Alarms and Event Rules
CloudFormation Guard Rules
Logging & Monitoring Configurations
Backups & DR
Auto Remediation Rules
Conformance Packs
Billing and Cost Management
S3 Bucket Policies
Security Groups & NACLs
IAM Policies
VPC Endpoint PoliciesAWS Services
Guided Walkthroughs
Configuration Packages
Reference Guides
Other
Service Control Policies
Restrict Access to AWS Based on the Requested Region (Disable Regions)
This SCP denies access to any operations outside of the specified AWS Region, except for actions in the listed services (These are global services that cannot be whitelisted based on region).
Some of the AWS services are exlcuded (global services): AWS IAM, AWS Organizations, AWS Route53, AWS Budgets, AWS WAF, AWS CloudFront, AWS Global Accelrator, AWS Snowball (Import/Export), AWS Support, AWS Health Dashboard, and Route53 Domain Registrations.
See Related Configuration Items for a Configuration Package to deploy multiple SCPs to an AWS Account.
Configuration template includes a CloudFormation custom resource to deploy into an AWS account.
Premium: 15-minute comprehensive assessment for your AWS Organization and Accounts
{
"Version": "2012-10-17",
"Statement": [
{
"NotAction": [
"a4b:*",
"acm:*",
"aws-marketplace-management:*",
"aws-marketplace:*",
"aws-portal:*",
"awsbillingconsole:*",
"budgets:*",
"ce:*",
"chime:*",
"cloudfront:*",
"config:*",
"cur:*",
"directconnect:*",
"ec2:DescribeRegions",
"ec2:DescribeTransitGateways",
"ec2:DescribeVpnGateways",
"fms:*",
"globalaccelerator:*",
"health:*",
"iam:*",
"importexport:*",
"kms:*",
"mobileanalytics:*",
"networkmanager:*",
"organizations:*",
"pricing:*",
"route53:*",
"route53domains:*",
"s3:GetAccountPublic*",
"s3:ListAllMyBuckets",
"s3:PutAccountPublic*",
"shield:*",
"sts:*",
"support:*",
"trustedadvisor:*",
"waf-regional:*",
"waf:*",
"wafv2:*",
"wellarchitected:*"
],
"Resource": "*",
"Effect": "Deny",
"Condition": {
"StringNotEquals": {
"aws:RequestedRegion": [
"us-east-1",
"us-west-1"
]
}
}
}
]
}Actions
Customize Template
Policy Parameters
* Required field
Upgrade to Premium for More Features
Configuration Packages
Pre-built packages for common configuration
Common SCPs
CloudFormation Guard Rules
Auto Remediation Rules
IAM Monitoring & Compliance
All Packages
Automated Assessments
- 350+ security checks
- Well-architected reviews
- Detailed compliance reports
- Remediation templates
- Email summaries
- Learn more