Create the service control policies in AWS Organization

To create the first SCP that blocks CloudTrail configuration actions

1. Choose the Policies tab and then choose Create policy.
2. For Policy name, enter Block CloudTrail Configuration Actions.
3. In the Policy section on the left, select CloudTrail for the service. Then choose the following actions: AddTags, CreateTrail, DeleteTrail, RemoveTags, StartLogging, StopLogging, and UpdateTrail.
4. Still in the left pane, choose Add resource and specify CloudTrail and All Resources. Then choose Add resource.The policy statement on the right updates to look similar to the following.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "Stmt1234567890123",
               "Effect": "Deny",
               "Action": [       
                   "cloudtrail:AddTags",    
                   "cloudtrail:CreateTrail",       
                   "cloudtrail:DeleteTrail",       
                   "cloudtrail:RemoveTags",       
                   "cloudtrail:StartLogging",       
                   "cloudtrail:StopLogging",       
                   "cloudtrail:UpdateTrail"
               ],
               "Resource": [
                   "*"
               ]
           }
       ]
   }

5. Choose Create policy.

To create the second policy that allows approved services for the production OU

1. From the list of policies, choose Create policy.
2. For Policy name, enter Allow List for All Approved Services.
3. Position your cursor in the right pane of the Policy section and paste in a policy like the following.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "Stmt1111111111111",
               "Effect": "Allow",
               "Action": [ 
                   "ec2:*",
                   "elasticloadbalancing:*",
                   "codecommit:*",
                   "cloudtrail:*",
                   "codedeploy:*"
                 ],
               "Resource": [ "*" ]
           }
       ]
   }

4. Choose Create policy.

To create the third policy that denies access to services that can’t be used in the MainApp OU

1. From the Policies tab, choose Create policy.
2. For Policy name, enter Deny List for MainApp Prohibited Services.
3. In the Policy section on the left, select Amazon DynamoDB for the service. For the action, choose All actions.
4. Still in the left pane, choose Add resource and specify DynamoDB and All Resources. Then choose Add resource.The policy statement on the right updates to look similar to the following.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Deny",
         "Action": [ "dynamodb:*" ],
         "Resource": [ "*" ]
       }
     ]
   }

5. Choose Create policy to save the SCP.

To attach the policies to the root and the OUs

1. Still on the Organize accounts tab, in the Details pane on the right, under POLICIES, choose SERVICE CONTROL POLICIES.
2. Choose Attach next to the SCP named Block CloudTrail Configuration Actions to prevent anyone from altering the way that you configured CloudTrail. In this tutorial, you attach it to the root so that it affects all member accounts.The Details pane now shows by highlighting that two SCPs are attached to the root: the one you just created and the default FullAWSAccess SCP.
3. Choose the Production OU (not the check box) to navigate to its contents.
4. Under POLICIES, choose SERVICE CONTROL POLICIES and then choose Attach next to Allow List for All Approved Services to enable users or roles in member accounts in the Production OU to access the approved services.
5. The information pane now shows that two SCPs are attached to the OU: the one that you just attached and the default FullAWSAccess SCP. However, because the FullAWSAccess SCP is also an allow list that allows all services and actions, you must detach this SCP to ensure that only your approved services are allowed.
6. To remove the default policy from the Production OU, next to FullAWSAccess, choose Detach. After you remove this default policy, all member accounts under the root immediately lose access to all actions and services that are not on the allow list SCP that you attached in the preceding step. Any requests to use actions that aren’t included in the Allow List for All Approved Services SCP are denied. This is true even if an administrator in an account grants access to another service by attaching an IAM permissions policy to a user in one of the member accounts.
7. Now you can attach the SCP named Deny List for MainApp Prohibited services to prevent anyone in the accounts in the MainApp OU from using any of the restricted services.To do this, choose the MainApp OU (not the check box) to navigate to its contents.
8. In the Details pane, under POLICIES, expand the Service control policies section. In the list of available policies, next to Deny List for MainApp Prohibited Services, choose Attach.