# Managed policies for your organization
**Warning**
We're currently releasing our new experience to a limited number of customers. You might not be able to access this experience yet.
When you use our new AWS experience, AWS manages the organization management policies including the resource control policies (RCPs) and the service control policies (SCPs). These protective controls prevent a project owner or team member from performing actions that would inhibit the preconfigured defaults AWS has defined to help you build and develop quickly.
## Service control policies for projects
The following is a service control policy for all users in a project and cannot be changed:
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "BlockOrgEscape",
"Effect" : "Deny",
"Action" : [
"account:CloseAccount",
"organizations:AcceptHandshake",
"organizations:LeaveOrganization",
"sso:CreateInstance"
],
"Resource" : "*"
},
{
"Sid" : "ProtectManagedRoles",
"Effect" : "Deny",
"Action" : [
"iam:AttachRolePolicy",
"iam:CreateRole",
"iam:DeleteRole",
"iam:DeleteRolePermissionsBoundary",
"iam:DeleteRolePolicy",
"iam:DetachRolePolicy",
"iam:PutRolePermissionsBoundary",
"iam:PutRolePolicy",
"iam:TagRole",
"iam:UntagRole",
"iam:UpdateAssumeRolePolicy",
"iam:UpdateRole"
],
"Resource" : "arn:*:iam::*:role/managed/*",
"Condition" : {
"StringNotLike" : {
"aws:PrincipalArn" : "arn:*:iam::*:role/managed/AWSManagedAccountManagementAccessRole"
}
}
}
]
}
```
This policy is not removed when you activate advanced features. For more information, see [Activate advanced AWS features](activate-advanced-features.md).
In addition, we apply the following service control policy for all users in a project to restrict certain modifications to your project that are either not supported or must be completed in AWS Settings:
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "BlockAccountManagementAPIs",
"Effect" : "Deny",
"Action" : [
"account:AcceptPrimaryEmailUpdate",
"account:DeleteAlternateContact",
"account:DisableRegion",
"account:EnableRegion",
"account:GetAlternateContact",
"account:GetContactInformation",
"account:GetGovCloudAccountInformation",
"account:GetRegionOptStatus",
"account:PutAccountName",
"account:PutAlternateContact",
"account:PutContactInformation",
"account:StartPrimaryEmailUpdate"
],
"Resource" : "*"
},
{
"Sid" : "DenyBillingOperations",
"Effect" : "Deny",
"Action" : "billing:*",
"Resource" : "*"
},
{
"Sid" : "DenyNotificationContactsOperations",
"Effect" : "Deny",
"Action" : "notifications-contacts:*",
"Resource" : "*"
},
{
"Sid" : "DenyRestrictedNotificationOperations",
"Effect" : "Deny",
"Action" : [
"notifications:AssociateChannel",
"notifications:AssociateManagedNotificationAccountContact",
"notifications:AssociateManagedNotificationAdditionalChannel",
"notifications:AssociateOrganizationalUnit",
"notifications:CreateEventRule",
"notifications:CreateNotificationConfiguration",
"notifications:DeleteEventRule",
"notifications:DeleteNotificationConfiguration",
"notifications:DeregisterNotificationHub",
"notifications:DisableNotificationsAccessForOrganization",
"notifications:DisassociateChannel",
"notifications:DisassociateManagedNotificationAccountContact",
"notifications:DisassociateManagedNotificationAdditionalChannel",
"notifications:DisassociateOrganizationalUnit",
"notifications:EnableNotificationsAccessForOrganization",
"notifications:GetEventRule",
"notifications:GetFeatureOptInStatus",
"notifications:GetNotificationConfiguration",
"notifications:GetNotificationEvent",
"notifications:GetNotificationsAccessForOrganization",
"notifications:ListChannels",
"notifications:ListEventRules",
"notifications:ListManagedNotificationChannelAssociations",
"notifications:ListMemberAccounts",
"notifications:ListNotificationConfigurations",
"notifications:ListNotificationEvents",
"notifications:ListNotificationHubs",
"notifications:ListOrganizationalUnits",
"notifications:ListTagsForResource",
"notifications:PutFeatureOptInStatus",
"notifications:RegisterNotificationHub",
"notifications:TagResource",
"notifications:UntagResource",
"notifications:UpdateEventRule",
"notifications:UpdateNotificationConfiguration"
],
"Resource" : "*"
},
{
"Sid" : "DenyRoleManagerDisablement",
"Effect" : "Deny",
"Action" : "iam:PutAccountProperties",
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"iam:AccountPropertyNamespaces" : "RoleManager"
}
}
}
]
}
```
This policy is removed when you activate advanced features. For more information, see [Activate advanced AWS features](activate-advanced-features.md).
In addition, we also apply the following service control policy for all users in a project to restrict AWS Regions to allow for support for partitional services, depending on your {{selected-region}}:
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "UsEast1Partitional",
"Effect" : "Deny",
"NotAction" : [
"account:*",
"acm:*",
"activate:*",
"artifact:*",
"aws-marketplace:*",
"bedrock-mantle:CallWithBearerToken",
"bedrock-mantle:CreateInference",
"bedrock-mantle:GetInference",
"bedrock-mantle:GetModel",
"bedrock-mantle:ListModels",
"bedrock:ApplyGuardrail",
"bedrock:CountTokens",
"bedrock:GetFoundationModel",
"bedrock:GetFoundationModelAvailability",
"bedrock:GetInferenceProfile",
"bedrock:InvokeModel",
"bedrock:InvokeModelWithResponseStream",
"bedrock:ListFoundationModels",
"bedrock:ListInferenceProfiles",
"budgets:*",
"ce:*",
"chatbot:*",
"cloudfront-keyvaluestore:*",
"cloudfront:*",
"cloudshell:*",
"cloudtrail:LookupEvents",
"cloudwatch:BatchGet*",
"cloudwatch:Describe*",
"cloudwatch:GenerateQuery",
"cloudwatch:Get*",
"cloudwatch:List*",
"consoleapp:*",
"cost-optimization-hub:*",
"ec2:DescribeRegions",
"ecr-public:*",
"freetier:*",
"health:*",
"iam:*",
"identitystore-auth:*",
"identitystore:*",
"invoicing:*",
"kms:CreateGrant",
"kms:Decrypt",
"kms:DescribeKey",
"kms:ListAliases",
"lightsail:AttachCertificateToDistribution",
"lightsail:CreateCertificate",
"lightsail:CreateContactMethod",
"lightsail:CreateDistribution",
"lightsail:CreateDomain",
"lightsail:CreateDomainEntry",
"lightsail:DeleteAlarm",
"lightsail:DeleteCertificate",
"lightsail:DeleteContactMethod",
"lightsail:DeleteDistribution",
"lightsail:DeleteDomain",
"lightsail:DeleteDomainEntry",
"lightsail:DetachCertificateFromDistribution",
"lightsail:Get*",
"lightsail:IsVpcPeered",
"lightsail:PutAlarm",
"lightsail:ResetDistributionCache",
"lightsail:SendContactMethodVerification",
"lightsail:SetIpAddressType",
"lightsail:TagResource",
"lightsail:TestAlarm",
"lightsail:UntagResource",
"lightsail:UpdateDistribution",
"lightsail:UpdateDistributionBundle",
"lightsail:UpdateDomainEntry",
"logs:*",
"managedblockchain-query:*",
"managedblockchain:*",
"mapcredits:*",
"notifications:GetManagedNotificationConfiguration",
"notifications:GetManagedNotificationEvent",
"notifications:ListManagedNotificationChildEvents",
"notifications:ListManagedNotificationConfigurations",
"notifications:ListManagedNotificationEvents",
"organizations:*",
"pricing:*",
"q:*",
"route53:*",
"route53domains:*",
"route53globalresolver:*",
"s3:GetBucketLocation",
"s3:ListAllMyBuckets",
"servicequotas:*",
"signin:*",
"sso-directory:*",
"sso-oauth:*",
"sso:*",
"sts:*",
"support:*",
"tax:*",
"trustedadvisor:*",
"uxc:*",
"waf:*",
"wafv2:*"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "us-east-1"
}
}
},
{
"Sid" : "DenyUsEast1WafResourceAssociation",
"Effect" : "Deny",
"Action" : [
"wafv2:AssociateWebACL",
"wafv2:DisassociateWebACL",
"wafv2:GetWebACLForResource",
"wafv2:ListResourcesForWebACL"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "us-east-1"
}
}
},
{
"Sid" : "UsWest2Partitional",
"Effect" : "Deny",
"NotAction" : [
"bedrock-mantle:CallWithBearerToken",
"bedrock-mantle:CreateInference",
"bedrock-mantle:GetInference",
"bedrock-mantle:GetModel",
"bedrock-mantle:ListModels",
"bedrock:ApplyGuardrail",
"bedrock:CountTokens",
"bedrock:GetFoundationModel",
"bedrock:GetFoundationModelAvailability",
"bedrock:GetInferenceProfile",
"bedrock:InvokeModel",
"bedrock:InvokeModelWithResponseStream",
"bedrock:ListFoundationModels",
"bedrock:ListInferenceProfiles",
"cloudshell:*",
"cloudtrail:LookupEvents",
"health:*",
"identitystore-auth:*",
"identitystore:*",
"kms:Decrypt",
"kms:DescribeKey",
"kms:ListAliases",
"networkmanager-chat:*",
"networkmanager:*",
"route53-recovery-cluster:*",
"route53-recovery-control-config:*",
"route53-recovery-readiness:*",
"servicequotas:*",
"sso-directory:*",
"sso-oauth:*",
"sso:*",
"support:*",
"trustedadvisor:*",
"uxc:*"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "us-west-2"
}
}
},
{
"Sid" : "RegionFloor",
"Effect" : "Deny",
"NotAction" : [
"bedrock-mantle:CallWithBearerToken",
"bedrock-mantle:CreateInference",
"bedrock-mantle:GetInference",
"bedrock-mantle:GetModel",
"bedrock-mantle:ListModels",
"bedrock:ApplyGuardrail",
"bedrock:CountTokens",
"bedrock:GetFoundationModel",
"bedrock:GetFoundationModelAvailability",
"bedrock:GetInferenceProfile",
"bedrock:InvokeModel",
"bedrock:InvokeModelWithResponseStream",
"bedrock:ListFoundationModels",
"bedrock:ListInferenceProfiles"
],
"Resource" : "*",
"Condition" : {
"StringNotEquals" : {
"aws:RequestedRegion" : [
"unspecified",
"us-east-1",
"{{selected-region}}",
"us-west-2"
]
}
}
}
]
}
```
After you activate advanced features, the following service control policy is applied to your account:
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "UsEast1Partitional",
"Effect" : "Deny",
"NotAction" : [
"a4b:*",
"access-analyzer:*",
"account-access:*",
"account:*",
"acm:*",
"activate:*",
"artifact:*",
"aws-marketplace-management:*",
"aws-marketplace:*",
"aws-portal:*",
"bedrock-mantle:CallWithBearerToken",
"bedrock-mantle:CreateInference",
"bedrock-mantle:GetInference",
"bedrock-mantle:GetModel",
"bedrock-mantle:ListModels",
"bedrock:ApplyGuardrail",
"bedrock:CountTokens",
"bedrock:GetFoundationModel",
"bedrock:GetFoundationModelAvailability",
"bedrock:GetInferenceProfile",
"bedrock:InvokeModel",
"bedrock:InvokeModelWithResponseStream",
"bedrock:ListFoundationModels",
"bedrock:ListInferenceProfiles",
"billing:*",
"billingconductor:*",
"budgets:*",
"builderid:*",
"ce:*",
"chatbot:*",
"chime:*",
"cloudfront-keyvaluestore:*",
"cloudfront:*",
"cloudshell:*",
"cloudtrail:LookupEvents",
"cloudwatch:BatchGet*",
"cloudwatch:Describe*",
"cloudwatch:GenerateQuery",
"cloudwatch:Get*",
"cloudwatch:List*",
"compute-optimizer:*",
"config:*",
"consoleapp:*",
"consolidatedbilling:*",
"cost-optimization-hub:*",
"cur:*",
"datapipeline:GetAccountLimits",
"devicefarm:*",
"directconnect:*",
"ec2:DescribeRegions",
"ec2:DescribeTransitGateways",
"ec2:DescribeVpnGateways",
"ecr-public:*",
"fms:*",
"freetier:*",
"globalaccelerator:*",
"health:*",
"iam:*",
"identitystore-auth:*",
"identitystore:*",
"importexport:*",
"invoicing:*",
"iq:*",
"kms:*",
"license-manager:ListReceivedLicenses",
"lightsail:AttachCertificateToDistribution",
"lightsail:CreateCertificate",
"lightsail:CreateContactMethod",
"lightsail:CreateDistribution",
"lightsail:CreateDomain",
"lightsail:CreateDomainEntry",
"lightsail:DeleteAlarm",
"lightsail:DeleteCertificate",
"lightsail:DeleteContactMethod",
"lightsail:DeleteDistribution",
"lightsail:DeleteDomain",
"lightsail:DeleteDomainEntry",
"lightsail:DetachCertificateFromDistribution",
"lightsail:Get*",
"lightsail:IsVpcPeered",
"lightsail:PutAlarm",
"lightsail:ResetDistributionCache",
"lightsail:SendContactMethodVerification",
"lightsail:SetIpAddressType",
"lightsail:TagResource",
"lightsail:TestAlarm",
"lightsail:UntagResource",
"lightsail:UpdateDistribution",
"lightsail:UpdateDistributionBundle",
"lightsail:UpdateDomainEntry",
"logs:*",
"managedblockchain-query:*",
"managedblockchain:*",
"mapcredits:*",
"mobileanalytics:*",
"networkmanager:*",
"notifications-contacts:*",
"notifications:*",
"organizations:*",
"payments:*",
"pricing:*",
"q:*",
"quicksight:DescribeAccountSubscription",
"resource-explorer-2:*",
"route53-recovery-cluster:*",
"route53-recovery-control-config:*",
"route53-recovery-readiness:*",
"route53:*",
"route53domains:*",
"route53globalresolver:*",
"s3:CreateMultiRegionAccessPoint",
"s3:DeleteMultiRegionAccessPoint",
"s3:DescribeMultiRegionAccessPointOperation",
"s3:GetAccountPublicAccessBlock",
"s3:GetBucketLocation",
"s3:GetBucketPolicyStatus",
"s3:GetBucketPublicAccessBlock",
"s3:GetMultiRegionAccessPoint",
"s3:GetMultiRegionAccessPointPolicy",
"s3:GetMultiRegionAccessPointPolicyStatus",
"s3:GetStorageLensConfiguration",
"s3:GetStorageLensDashboard",
"s3:ListAllMyBuckets",
"s3:ListMultiRegionAccessPoints",
"s3:ListStorageLensConfigurations",
"s3:PutAccountPublicAccessBlock",
"s3:PutMultiRegionAccessPointPolicy",
"savingsplans:*",
"servicequotas:*",
"shield:*",
"signin:*",
"sso-directory:*",
"sso-oauth:*",
"sso:*",
"sts:*",
"support:*",
"supportapp:*",
"supportplans:*",
"sustainability:*",
"tag:GetResources",
"tax:*",
"trustedadvisor:*",
"uxc:*",
"vendor-insights:ListEntitledSecurityProfiles",
"waf-regional:*",
"waf:*",
"wafv2:*"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "us-east-1"
}
}
},
{
"Sid" : "UsWest2Partitional",
"Effect" : "Deny",
"NotAction" : [
"bedrock-mantle:CallWithBearerToken",
"bedrock-mantle:CreateInference",
"bedrock-mantle:GetInference",
"bedrock-mantle:GetModel",
"bedrock-mantle:ListModels",
"bedrock:ApplyGuardrail",
"bedrock:CountTokens",
"bedrock:GetFoundationModel",
"bedrock:GetFoundationModelAvailability",
"bedrock:GetInferenceProfile",
"bedrock:InvokeModel",
"bedrock:InvokeModelWithResponseStream",
"bedrock:ListFoundationModels",
"bedrock:ListInferenceProfiles",
"cloudshell:*",
"cloudtrail:LookupEvents",
"health:*",
"identitystore-auth:*",
"identitystore:*",
"kms:Decrypt",
"kms:DescribeKey",
"kms:ListAliases",
"networkmanager-chat:*",
"networkmanager:*",
"route53-recovery-cluster:*",
"route53-recovery-control-config:*",
"route53-recovery-readiness:*",
"servicequotas:*",
"sso-directory:*",
"sso-oauth:*",
"sso:*",
"support:*",
"trustedadvisor:*",
"uxc:*"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "us-west-2"
}
}
},
{
"Sid" : "RegionFloor",
"Effect" : "Deny",
"NotAction" : [
"bedrock-mantle:CallWithBearerToken",
"bedrock-mantle:CreateInference",
"bedrock-mantle:GetInference",
"bedrock-mantle:GetModel",
"bedrock-mantle:ListModels",
"bedrock:ApplyGuardrail",
"bedrock:CountTokens",
"bedrock:GetFoundationModel",
"bedrock:GetFoundationModelAvailability",
"bedrock:GetInferenceProfile",
"bedrock:InvokeModel",
"bedrock:InvokeModelWithResponseStream",
"bedrock:ListFoundationModels",
"bedrock:ListInferenceProfiles"
],
"Resource" : "*",
"Condition" : {
"StringNotEquals" : {
"aws:RequestedRegion" : [
"unspecified",
"us-east-1",
"{{selected-region}}",
"us-west-2"
]
}
}
}
]
}
```
### Service control policies for spend limits
If you use a spend limit, the following service control policies are applied to your project as it nears the spend limit. For more information about spend limits, see [Create a spend limit in AWS Settings](create-spend-limit.md).
```
{
"Version": "2012-10-17",
"Statement": {
"Sid": "DenyBedrockUsage",
"Effect": "Deny",
"Action": [
"bedrock:ApplyGuardrail",
"bedrock:CallWithBearerToken",
"bedrock:InvokeAgent",
"bedrock:InvokeAutomatedReasoningPolicy",
"bedrock:InvokeDataAutomation",
"bedrock:InvokeDataAutomationAsync",
"bedrock:InvokeFlow",
"bedrock:InvokeInlineAgent",
"bedrock:InvokeModel",
"bedrock:InvokeModelWithResponseStream",
"bedrock:InvokeTool",
"bedrock:OptimizePrompt",
"bedrock:Retrieve",
"bedrock:RetrieveAndGenerate",
"bedrock:StartFlowExecution",
"bedrock-mantle:CallWithBearerToken",
"bedrock-mantle:CreateInference"
],
"Resource": "*"
}
}
```
```
{
"Version": "2012-10-17",
"Statement": {
"Sid": "DenyLambdaUsage",
"Effect": "Deny",
"Action": [
"lambda:DeleteFunctionConcurrency",
"lambda:InvokeAsync",
"lambda:InvokeFunction",
"lambda:InvokeFunctionUrl",
"lambda:PutFunctionConcurrency"
],
"Resource": "*"
}
}
```
```
{
"Version": "2012-10-17",
"Statement": {
"Sid": "DenySageMakerInference",
"Effect": "Deny",
"Action": [
"sagemaker:InvokeEndpoint",
"sagemaker:InvokeEndpointAsync",
"sagemaker:InvokeEndpointWithResponseStream"
],
"Resource": "*"
}
}
```
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyCompute",
"Effect": "Deny",
"Action": [
"ec2:CreateNatGateway",
"ec2:CreateVolume",
"ec2:CreateVpnConnection",
"ec2:RunInstances",
"ec2:StartInstances",
"elasticloadbalancing:CreateLoadBalancer",
"autoscaling:CreateAutoScalingGroup",
"ecs:CreateService",
"eks:CreateCluster",
"eks:CreateNodegroup",
"eks:CreateFargateProfile",
"elasticbeanstalk:CreateEnvironment",
"apprunner:CreateService",
"apprunner:ResumeService",
"batch:CreateComputeEnvironment",
"elasticmapreduce:RunJobFlow",
"appstream:CreateFleet"
],
"Resource": "*"
},
{
"Sid": "DenyLambda",
"Effect": "Deny",
"Action": "lambda:CreateFunction",
"Resource": "*"
},
{
"Sid": "DenyDatabase",
"Effect": "Deny",
"Action": [
"rds:CreateDBCluster",
"rds:CreateDBInstance",
"rds:RestoreDBClusterFromS3",
"rds:RestoreDBClusterFromSnapshot",
"rds:RestoreDBClusterToPointInTime",
"rds:RestoreDBInstanceFromDBSnapshot",
"rds:RestoreDBInstanceFromS3",
"rds:RestoreDBInstanceToPointInTime",
"rds:StartDBCluster",
"rds:StartDBInstance",
"dynamodb:CreateTable",
"dynamodb:CreateGlobalTable",
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup",
"timestream:CreateDatabase",
"timestream:CreateTable",
"memorydb:CreateCluster",
"es:CreateDomain",
"aoss:CreateCollection",
"redshift:CreateCluster",
"redshift:ResumeCluster",
"redshift-serverless:CreateWorkgroup",
"dsql:CreateCluster"
],
"Resource": "*"
},
{
"Sid": "DenyStorage",
"Effect": "Deny",
"Action": [
"elasticfilesystem:CreateFileSystem",
"datasync:CreateTask",
"storagegateway:ActivateGateway",
"glacier:CreateVault"
],
"Resource": "*"
},
{
"Sid": "DenySageMaker",
"Effect": "Deny",
"Action": [
"sagemaker:CreateApp",
"sagemaker:CreateEndpoint",
"sagemaker:CreateNotebookInstance",
"sagemaker:CreateProcessingJob",
"sagemaker:CreateTrainingJob",
"sagemaker:CreateTransformJob",
"sagemaker:StartNotebookInstance"
],
"Resource": "*"
},
{
"Sid": "DenyBedrock",
"Effect": "Deny",
"Action": [
"bedrock:CreateCustomModelDeployment",
"bedrock:CreateDataAutomationProject",
"bedrock:CreateEvaluationJob",
"bedrock:CreateMarketplaceModelEndpoint",
"bedrock:CreateModelCustomizationJob",
"bedrock:CreateModelImportJob",
"bedrock:CreateModelInvocationJob",
"bedrock:CreateProvisionedModelThroughput",
"bedrock-mantle:CreateCustomizedModel",
"bedrock-mantle:CreateFineTuningJob",
"bedrock-mantle:CreateReservation"
],
"Resource": "*"
},
{
"Sid": "DenyAIML",
"Effect": "Deny",
"Action": [
"kendra:CreateIndex",
"personalize:CreateSolution",
"personalize:CreateCampaign",
"forecast:CreatePredictor",
"forecast:CreateForecast",
"rekognition:CreateProject",
"lex:CreateBot"
],
"Resource": "*"
},
{
"Sid": "DenyNetworking",
"Effect": "Deny",
"Action": [
"cloudfront:CreateDistribution",
"route53:CreateHostedZone",
"appmesh:CreateMesh"
],
"Resource": "*"
},
{
"Sid": "DenyApiGatewayCreate",
"Effect": "Deny",
"Action": "apigateway:POST",
"Resource": [
"arn:aws:apigateway:*::/restapis",
"arn:aws:apigateway:*::/apis"
]
},
{
"Sid": "DenyMessaging",
"Effect": "Deny",
"Action": [
"mq:CreateBroker",
"kafka:CreateCluster",
"kafka:CreateVpcConnection",
"kinesis:CreateStream",
"firehose:CreateDeliveryStream",
"kinesisanalytics:CreateApplication",
"kinesisvideo:CreateStream",
"sns:CreateTopic",
"sqs:CreateQueue",
"events:CreateEventBus",
"pipes:CreatePipe",
"scheduler:CreateSchedule"
],
"Resource": "*"
},
{
"Sid": "DenyAnalytics",
"Effect": "Deny",
"Action": [
"states:CreateStateMachine",
"glue:CreateJob",
"glue:CreateCrawler",
"athena:CreateWorkGroup",
"appsync:CreateGraphqlApi",
"appflow:CreateFlow",
"datazone:CreateDomain",
"datazone:CreateProject",
"entityresolution:CreateMatchingWorkflow",
"datapipeline:CreatePipeline",
"dataexchange:CreateDataSet"
],
"Resource": "*"
},
{
"Sid": "DenyDevTools",
"Effect": "Deny",
"Action": [
"amplify:CreateApp",
"amplify:CreateBranch",
"cloud9:CreateEnvironmentEC2",
"codebuild:CreateProject",
"codepipeline:CreatePipeline",
"codedeploy:CreateApplication",
"cloudformation:CreateStack",
"cloudformation:CreateStackSet",
"codeartifact:CreateRepository",
"codeartifact:CreateDomain"
],
"Resource": "*"
},
{
"Sid": "DenySecurity",
"Effect": "Deny",
"Action": [
"kms:CreateKey",
"wafv2:CreateWebACL",
"cloudhsm:CreateCluster",
"network-firewall:CreateFirewall",
"secretsmanager:CreateSecret",
"acm-pca:CreateCertificateAuthority",
"cognito-idp:CreateUserPool",
"cognito-identity:CreateIdentityPool",
"ds:CreateDirectory",
"ds:CreateMicrosoftAD",
"fms:PutPolicy",
"payment-cryptography:CreateKey"
],
"Resource": "*"
},
{
"Sid": "DenyMedia",
"Effect": "Deny",
"Action": [
"medialive:CreateChannel",
"mediapackage:CreateChannel",
"mediaconnect:CreateFlow",
"mediatailor:CreateChannel"
],
"Resource": "*"
},
{
"Sid": "DenyIoT",
"Effect": "Deny",
"Action": [
"iot:CreateThing",
"iot:CreateTopicRule",
"iotevents:CreateDetectorModel",
"iottwinmaker:CreateWorkspace",
"iotsitewise:CreateAssetModel",
"iotsitewise:CreatePortal",
"iotfleetwise:CreateCampaign"
],
"Resource": "*"
},
{
"Sid": "DenyMisc",
"Effect": "Deny",
"Action": [
"ses:CreateConfigurationSet",
"ecr:CreateRepository",
"aps:CreateWorkspace",
"healthlake:CreateFHIRDatastore",
"transfer:CreateServer",
"managedblockchain:CreateNetwork",
"managedblockchain:CreateMember",
"route53-recovery-control-config:CreateCluster",
"fis:CreateExperimentTemplate",
"appfabric:CreateAppBundle",
"appfabric:CreateIngestion",
"b2bi:CreateProfile",
"b2bi:CreateTransformer",
"geo:CreateMap",
"geo:CreatePlaceIndex",
"geo:CreateTracker",
"geo:CreateGeofenceCollection",
"geo:CreateRouteCalculator"
],
"Resource": "*"
}
]
}
```
## Service control policies for the Free Tier for projects
The following service control policy controls access to the AWS services available in the Free Tier of our new AWS experience. This policy cannot be modified. To access additional services, upgrade your account. For more information, see [Upgrade your account in AWS Settings](upgrade-account.md).
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowFreeTierServices",
"Effect": "Deny",
"NotAction": [
"a2c:*",
"access-analyzer:CheckAccessNotGranted",
"access-analyzer:CheckNoNewAccess",
"access-analyzer:CheckNoPublicAccess",
"access-analyzer:ValidatePolicy",
"account:*",
"acm:*",
"aco-automation:*",
"action-recommendations:*",
"activate:*",
"aiops:*",
"airflow-serverless:*",
"amplify:*",
"amplifybackend:*",
"amplifyuibuilder:*",
"aoss:*",
"apigateway:*",
"app-integrations:*",
"appconfig:*",
"appflow:*",
"application-autoscaling:*",
"application-signals-mcp:*",
"application-signals:*",
"application-transformation:*",
"applicationinsights:*",
"appmesh:*",
"appsync:*",
"aps:*",
"arc-zonal-shift:*",
"artifact:*",
"athena:*",
"autoscaling-plans:*",
"autoscaling:*",
"aws-external-anthropic:*",
"aws-marketplace:*",
"b2bi:*",
"backup-gateway:*",
"backup-search:*",
"backup-storage:*",
"backup:*",
"batch:*",
"bcm-pricing-calculator:*",
"bedrock-agentcore:*",
"bedrock-mantle:*",
"bedrock-websearch:*",
"bedrock:*",
"budgets:*",
"ce:*",
"chatbot:*",
"cloud9:*",
"cloudformation:*",
"cloudfront-keyvaluestore:*",
"cloudfront:*",
"cloudshell:*",
"cloudtrail-data:*",
"cloudtrail:*",
"cloudwatch:*",
"codeartifact:*",
"codebuild:*",
"codecommit:*",
"codeconnections:*",
"codedeploy-commands-secure:*",
"codedeploy:*",
"codepipeline:*",
"codestar-connections:*",
"codestar-notifications:*",
"cognito-identity:*",
"cognito-idp:*",
"cognito-sync:*",
"compute-optimizer:*",
"config:*",
"consoleapp:*",
"consolidatedbilling:*",
"cost-optimization-hub:*",
"customer-verification:*",
"databrew:*",
"datapipeline:*",
"datasync:*",
"datazone:*",
"dbqms:*",
"dlm:*",
"ds-data:*",
"ds:*",
"dsql:*",
"dynamodb:*",
"ebs:*",
"ec2-instance-connect:*",
"ec2:*",
"ec2messages:*",
"ecr-public:*",
"ecr:*",
"ecs-mcp:*",
"ecs:*",
"eks-auth:*",
"eks-mcp:*",
"eks:*",
"elasticache:*",
"elasticbeanstalk:*",
"elasticfilesystem:*",
"elasticloadbalancing:*",
"entityresolution:*",
"es:*",
"events:*",
"evidently:*",
"execute-api:*",
"finops-agent:*",
"freertos:*",
"freetier:*",
"geo-maps:*",
"geo-places:*",
"geo-routes:*",
"geo:*",
"glue:*",
"groundtruthlabeling:*",
"health:*",
"iam:*",
"identitystore-auth:*",
"identitystore:*",
"imagebuilder:*",
"internetmonitor:*",
"invoicing:*",
"iot-device-tester:*",
"iot:*",
"iotdeviceadvisor:*",
"iotfleethub:*",
"iotjobsdata:*",
"iotmanagedintegrations:*",
"iotsitewise:*",
"iottwinmaker:*",
"iotwireless:*",
"kms:*",
"lakeformation:*",
"lambda:*",
"launchwizard:*",
"lex:*",
"license-manager-linux-subscriptions:*",
"license-manager-user-subscriptions:*",
"license-manager:*",
"logs:*",
"mgn:*",
"migrationhub-orchestrator:*",
"migrationhub-strategy:*",
"mpa:*",
"mq:*",
"networkflowmonitor:*",
"networkmanager-chat:*",
"networkmanager:*",
"networkmonitor:*",
"notifications-contacts:*",
"notifications:*",
"nova-act:*",
"oam:*",
"observabilityadmin:*",
"opensearch:*",
"organizations:*",
"osis:*",
"payment-cryptography:*",
"pi:*",
"pipes:*",
"polly:*",
"pricing:*",
"q:DeleteConversation",
"q:GenerateCodeFromCommands",
"q:GenerateCodeRecommendations",
"q:GetConversation",
"q:GetIdentityMetadata",
"q:GetTroubleshootingResults",
"q:ListConversations",
"q:PassRequest",
"q:SendEvent",
"q:SendMessage",
"q:StartConversation",
"q:StartTroubleshootingAnalysis",
"q:StartTroubleshootingResolutionExplanation",
"q:UpdateConversation",
"q:UpdateTroubleshootingCommandResult",
"q:UsePlugin",
"ram:*",
"rbin:*",
"rds-data:*",
"rds-db:*",
"rds:*",
"rekognition:*",
"resource-explorer-2:*",
"resource-explorer:*",
"resource-groups:*",
"rhelkb:*",
"route53-recovery-cluster:*",
"route53-recovery-control-config:*",
"route53-recovery-readiness:*",
"route53:*",
"route53domains:*",
"route53globalresolver:*",
"route53profiles:*",
"route53resolver:*",
"rum:*",
"s3-object-lambda:*",
"s3:*",
"s3express:*",
"s3files:*",
"s3tables:*",
"s3vectors:*",
"sagemaker-data-science-assistant:*",
"sagemaker-geospatial:*",
"sagemaker-mlflow:*",
"sagemaker-unified-studio-mcp:*",
"sagemaker:*",
"scheduler:*",
"schemas:*",
"secretsmanager:*",
"serverlessrepo:*",
"servicecatalog:Describe*",
"servicecatalog:List*",
"servicecatalog:ProvisionProduct",
"servicecatalog:ScanProvisionedProducts",
"servicecatalog:SearchProducts",
"servicecatalog:SearchProvisionedProducts",
"servicecatalog:TerminateProvisionedProduct",
"servicecatalog:UpdateProvisionedProduct",
"servicediscovery:*",
"serviceextract:*",
"servicequotas:*",
"ses:*",
"signer:*",
"signin:*",
"sns:*",
"sqlworkbench:*",
"sqs:*",
"ssm-contacts:*",
"ssm-guiconnect:*",
"ssm-incidents:*",
"ssm-quicksetup:*",
"ssm-sap:*",
"ssm:*",
"ssmmessages:*",
"sso-directory:*",
"sso-oauth:*",
"sso:*",
"states:*",
"sts:*",
"support:*",
"swf:*",
"synthetics:*",
"tag:*",
"tax:*",
"timestream-influxdb:*",
"ts:*",
"uxc:*",
"verifiedpermissions:*",
"vpce:*",
"waf-regional:*",
"waf:*",
"wafv2:*",
"wellarchitected:*",
"xray:*"
],
"Resource": "*"
},
{
"Sid": "DenyEC2CapacityBlock",
"Effect": "Deny",
"Action": ["ec2:PurchaseCapacityBlock", "ec2:PurchaseCapacityBlockExtension"],
"Resource": "*"
},
{
"Sid": "DenyRestrictedAgreements",
"Effect": "Deny",
"Action": ["artifact:AcceptAgreement", "artifact:AcceptNdaForAgreement"],
"Resource": [
"arn:aws:artifact:::agreement/agreement-9c1kBcYznTkcpRIm",
"arn:aws:artifact:::agreement/agreement-y03aUwMAEorHtqjv",
"arn:aws:artifact:::agreement/agreement-bexgr7sjvXAW4Gxu",
"arn:aws:artifact:::agreement/agreement-HZTdNwJuqOKLReXC"
]
},
{
"Sid": "DenyDocDB",
"Effect": "Deny",
"Action": ["rds:CreateDBCluster", "rds:CreateDBInstance"],
"Resource": "*",
"Condition": {
"StringEquals": {
"rds:DatabaseEngine": ["docdb"]
}
}
},
{
"Sid": "DenyCloudWAN",
"Effect": "Deny",
"Action": [
"networkmanager:CreateCoreNetwork",
"networkmanager:CreateConnectAttachment",
"networkmanager:CreateConnectPeer",
"networkmanager:CreateVpcAttachment",
"networkmanager:CreateSiteToSiteVpnAttachment",
"networkmanager:CreateTransitGatewayPeering",
"networkmanager:CreateDirectConnectGatewayAttachment",
"networkmanager:PutCoreNetworkPolicy",
"networkmanager:ExecuteCoreNetworkChangeSet"
],
"Resource": "*"
},
{
"Sid": "DenyTransitGatewayAndVPN",
"Effect": "Deny",
"Action": [
"ec2:CreateTransitGateway",
"ec2:CreateTransitGatewayVpcAttachment",
"ec2:CreateTransitGatewayConnect",
"ec2:CreateTransitGatewayConnectPeer",
"ec2:CreateTransitGatewayMulticastDomain",
"ec2:CreateTransitGatewayPeeringAttachment",
"ec2:CreateTransitGatewayPolicyTable",
"ec2:CreateTransitGatewayPrefixListReference",
"ec2:CreateTransitGatewayRoute",
"ec2:CreateTransitGatewayRouteTable",
"ec2:CreateTransitGatewayRouteTableAnnouncement",
"ec2:CreateClientVpnEndpoint",
"ec2:CreateClientVpnRoute",
"ec2:AuthorizeClientVpnIngress",
"ec2:AssociateClientVpnTargetNetwork",
"ec2:CreateVpnConnection",
"ec2:CreateVpnConnectionRoute",
"ec2:CreateVpnGateway",
"ec2:CreateCustomerGateway"
],
"Resource": "*"
},
{
"Sid": "DenySageMakerGroundTruth",
"Effect": "Deny",
"Action": [
"sagemaker:CreateLabelingJob",
"sagemaker:CreateWorkteam",
"sagemaker:CreateWorkforce",
"sagemaker:CreateHumanTaskUi"
],
"Resource": "*"
},
{
"Sid": "DenyGlacierStorageClasses",
"Effect": "Deny",
"Action": ["s3:PutObject"],
"Resource": "*",
"Condition": {
"StringEquals": {
"s3:x-amz-storage-class": ["DEEP_ARCHIVE", "GLACIER"]
}
}
},
{
"Sid": "DenyEC2Fleet",
"Effect": "Deny",
"Action": ["ec2:CreateFleet"],
"Resource": "*"
},
{
"Sid": "DenyEC2BYOLAndLicenseConfigurations",
"Effect": "Deny",
"Action": ["ec2:RunInstances", "ec2:StartInstances"],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringEquals": {
"ec2:Tenancy": "host"
}
}
},
{
"Sid": "DenyEC2InstanceStoreRootDevice",
"Effect": "Deny",
"Action": ["ec2:RunInstances"],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringEquals": {
"ec2:RootDeviceType": "instance-store"
}
}
},
{
"Sid": "DenyLicenseManagerAssociation",
"Effect": "Deny",
"Action": ["license-manager:CreateLicenseConfiguration"],
"Resource": "*"
},
{
"Sid": "DenyIAMRestrictedActions",
"Effect": "Deny",
"Action": [
"iam:*Alias*",
"iam:*Organizations*",
"iam:*Provider*",
"iam:SetSecurityTokenServicePreferences",
"iam:*LoginProfile*",
"iam:CreateGroup",
"iam:AttachGroupPolicy",
"iam:AddUserToGroup",
"iam:PutGroupPolicy",
"iam:UpdateGroup",
"iam:UpdateServerCertificate",
"iam:UpdateSigningCertificate",
"iam:UploadServerCertificate",
"iam:UploadSigningCertificate",
"iam:TagServerCertificate",
"iam:UntagServerCertificate"
],
"Resource": "*"
},
{
"Sid": "DenySSOCreateInstance",
"Effect": "Deny",
"Action": ["sso:CreateInstance"],
"Resource": "*"
},
{
"Sid": "DenyRequestSpotInstances",
"Effect": "Deny",
"Action": ["ec2:RequestSpotInstances"],
"Resource": "*"
},
{
"Sid": "DenySpotMarketType",
"Effect": "Deny",
"Action": ["ec2:RunInstances"],
"Resource": "*",
"Condition": {
"StringEquals": {
"ec2:InstanceMarketType": "spot"
}
}
},
{
"Sid": "DenyReservedInstanceAndCapacityPurchases",
"Effect": "Deny",
"Action": [
"athena:CreateCapacityReservation",
"cloudfront:CreateSavingsPlan",
"dynamodb:PurchaseReservedCapacityOfferings",
"ec2:AllocateHosts",
"ec2:CreateCapacityReservation",
"ec2:CreateCapacityReservationBySplitting",
"ec2:CreateCapacityReservationCancellationQuote",
"ec2:CreateCapacityReservationFleet",
"ec2:PurchaseHostReservation",
"ec2:PurchaseReservedInstancesOffering",
"ec2:PurchaseScheduledInstances",
"elasticache:PurchaseReservedCacheNodesOffering",
"es:PurchaseReservedElasticsearchInstanceOffering",
"es:PurchaseReservedInstanceOffering",
"glacier:PurchaseProvisionedCapacity",
"memorydb:PurchaseReservedNodesOffering",
"rds:PurchaseReservedDBInstancesOffering",
"redshift:AcceptReservedNodeExchange",
"redshift:PurchaseReservedNodeOffering",
"sagemaker:CreateReservedCapacity",
"savingsplans:CreateSavingsPlan"
],
"Resource": "*"
},
{
"Sid": "DenyExportableCertificateRequests",
"Effect": "Deny",
"Action": ["acm:RequestCertificate"],
"Resource": "*",
"Condition": {
"StringEquals": {
"acm:AllowExport": "true"
}
}
}
]
}
```
## Service control policies for the Paid Plan for projects
The following service control policy controls access to the AWS services available in the Paid Plan of our new AWS experience. This policy cannot be modified. To access additional services, activate advanced features. For more information, see [Activate advanced AWS features](activate-advanced-features.md).
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowPaidTierServices",
"Effect": "Deny",
"NotAction": [
"a2c:*",
"access-analyzer:CheckAccessNotGranted",
"access-analyzer:CheckNoNewAccess",
"access-analyzer:CheckNoPublicAccess",
"access-analyzer:ValidatePolicy",
"account:*",
"acm:*",
"aco-automation:*",
"action-recommendations:*",
"activate:*",
"aidevops:*",
"aiops:*",
"airflow-serverless:*",
"amplify:*",
"amplifybackend:*",
"amplifyuibuilder:*",
"aoss:*",
"apigateway:*",
"app-integrations:*",
"appconfig:*",
"appfabric:*",
"appflow:*",
"application-autoscaling:*",
"application-signals-mcp:*",
"application-signals:*",
"application-transformation:*",
"applicationinsights:*",
"appmesh:*",
"appsync:*",
"aps:*",
"arc-zonal-shift:*",
"artifact:*",
"athena:*",
"autoscaling-plans:*",
"autoscaling:*",
"aws-external-anthropic:*",
"aws-marketplace:*",
"b2bi:*",
"backup-gateway:*",
"backup-search:*",
"backup-storage:*",
"backup:*",
"batch:*",
"bcm-pricing-calculator:*",
"bedrock-agentcore:*",
"bedrock-mantle:*",
"bedrock-websearch:*",
"bedrock:*",
"budgets:*",
"ce:*",
"chatbot:*",
"cloud9:*",
"cloudformation:*",
"cloudfront-keyvaluestore:*",
"cloudfront:*",
"cloudshell:*",
"cloudtrail-data:*",
"cloudtrail:*",
"cloudwatch:*",
"codeartifact:*",
"codebuild:*",
"codecommit:*",
"codeconnections:*",
"codedeploy-commands-secure:*",
"codedeploy:*",
"codeguru-profiler:*",
"codeguru-reviewer:*",
"codeguru-security:*",
"codepipeline:*",
"codestar-connections:*",
"codestar-notifications:*",
"cognito-identity:*",
"cognito-idp:*",
"cognito-sync:*",
"compute-optimizer:*",
"config:*",
"consoleapp:*",
"consolidatedbilling:*",
"cost-optimization-hub:*",
"customer-verification:*",
"databrew:*",
"dataexchange:*",
"datapipeline:*",
"datasync:*",
"datazone:*",
"dbqms:*",
"devops-guru:*",
"dlm:*",
"docdb-elastic:*",
"ds-data:*",
"ds:*",
"dsql:*",
"dynamodb:*",
"ebs:*",
"ec2-instance-connect:*",
"ec2:*",
"ec2messages:*",
"ecr-public:*",
"ecr:*",
"ecs-mcp:*",
"ecs:*",
"eks-auth:*",
"eks-mcp:*",
"eks:*",
"elasticache:*",
"elasticbeanstalk:*",
"elasticfilesystem:*",
"elasticloadbalancing:*",
"elasticmapreduce:*",
"emr-containers:*",
"emr-serverless:*",
"entityresolution:*",
"es:*",
"events:*",
"evidently:*",
"execute-api:*",
"finops-agent:*",
"firehose:*",
"fis:*",
"fms:*",
"forecast:*",
"freertos:*",
"freetier:*",
"geo-maps:*",
"geo-places:*",
"geo-routes:*",
"geo:*",
"glacier:*",
"glue:*",
"groundtruthlabeling:*",
"health:*",
"iam:*",
"identitystore-auth:*",
"identitystore:*",
"imagebuilder:*",
"internetmonitor:*",
"invoicing:*",
"iot-device-tester:*",
"iot:*",
"iotdeviceadvisor:*",
"iotfleethub:*",
"iotjobsdata:*",
"iotmanagedintegrations:*",
"iotsitewise:*",
"iottwinmaker:*",
"iotwireless:*",
"kafka-cluster:*",
"kafka:*",
"kafkaconnect:*",
"kinesis:*",
"kinesisanalytics:*",
"kinesisvideo:*",
"kms:*",
"lakeformation:*",
"lambda:*",
"launchwizard:*",
"lex:*",
"license-manager-linux-subscriptions:*",
"license-manager-user-subscriptions:*",
"license-manager:*",
"logs:*",
"managedblockchain-query:*",
"managedblockchain:*",
"mapcredits:*",
"memorydb:*",
"mgn:*",
"migrationhub-orchestrator:*",
"migrationhub-strategy:*",
"mpa:*",
"mq:*",
"neptune-db:*",
"neptune-graph:*",
"network-firewall:*",
"networkflowmonitor:*",
"networkmanager-chat:*",
"networkmanager:*",
"networkmonitor:*",
"notifications-contacts:*",
"notifications:*",
"nova-act:*",
"oam:*",
"observabilityadmin:*",
"opensearch:*",
"organizations:*",
"osis:*",
"payment-cryptography:*",
"personalize:*",
"pi:*",
"pipes:*",
"polly:*",
"pricing:*",
"q:DeleteConversation",
"q:GenerateCodeFromCommands",
"q:GenerateCodeRecommendations",
"q:GetConversation",
"q:GetIdentityMetadata",
"q:GetTroubleshootingResults",
"q:ListConversations",
"q:PassRequest",
"q:SendEvent",
"q:SendMessage",
"q:StartConversation",
"q:StartTroubleshootingAnalysis",
"q:StartTroubleshootingResolutionExplanation",
"q:UpdateConversation",
"q:UpdateTroubleshootingCommandResult",
"q:UsePlugin",
"ram:*",
"rbin:*",
"rds-data:*",
"rds-db:*",
"rds:*",
"redshift-data:*",
"redshift-serverless:*",
"redshift:*",
"rekognition:*",
"resource-explorer-2:*",
"resource-explorer:*",
"resource-groups:*",
"rhelkb:*",
"route53-recovery-cluster:*",
"route53-recovery-control-config:*",
"route53-recovery-readiness:*",
"route53:*",
"route53domains:*",
"route53globalresolver:*",
"route53profiles:*",
"route53resolver:*",
"rum:*",
"s3-object-lambda:*",
"s3:*",
"s3express:*",
"s3files:*",
"s3tables:*",
"s3vectors:*",
"sagemaker-data-science-assistant:*",
"sagemaker-geospatial:*",
"sagemaker-mlflow:*",
"sagemaker-unified-studio-mcp:*",
"sagemaker:*",
"scheduler:*",
"schemas:*",
"secretsmanager:*",
"securityagent:*",
"serverlessrepo:*",
"servicecatalog:Describe*",
"servicecatalog:List*",
"servicecatalog:ProvisionProduct",
"servicecatalog:ScanProvisionedProducts",
"servicecatalog:SearchProducts",
"servicecatalog:SearchProvisionedProducts",
"servicecatalog:TerminateProvisionedProduct",
"servicecatalog:UpdateProvisionedProduct",
"servicediscovery:*",
"serviceextract:*",
"servicequotas:*",
"ses:*",
"signer:*",
"signin:*",
"sms-voice:*",
"sns:*",
"social-messaging:*",
"sqlworkbench:*",
"sqs:*",
"ssm-contacts:*",
"ssm-guiconnect:*",
"ssm-incidents:*",
"ssm-quicksetup:*",
"ssm-sap:*",
"ssm:*",
"ssmmessages:*",
"sso-directory:*",
"sso-oauth:*",
"sso:*",
"states:*",
"storagegateway:*",
"sts:*",
"support:*",
"swf:*",
"synthetics:*",
"tag:*",
"tax:*",
"textract:*",
"timestream-influxdb:*",
"timestream:*",
"transcribe:*",
"translate:*",
"ts:*",
"uxc:*",
"verifiedpermissions:*",
"vpce:*",
"waf-regional:*",
"waf:*",
"wafv2:*",
"wellarchitected:*",
"xray:*"
],
"Resource": "*"
},
{
"Sid": "DenyEC2CapacityBlock",
"Effect": "Deny",
"Action": ["ec2:PurchaseCapacityBlock", "ec2:PurchaseCapacityBlockExtension"],
"Resource": "*"
},
{
"Sid": "DenyRestrictedAgreements",
"Effect": "Deny",
"Action": ["artifact:AcceptAgreement", "artifact:AcceptNdaForAgreement"],
"Resource": [
"arn:aws:artifact:::agreement/agreement-9c1kBcYznTkcpRIm",
"arn:aws:artifact:::agreement/agreement-y03aUwMAEorHtqjv",
"arn:aws:artifact:::agreement/agreement-bexgr7sjvXAW4Gxu",
"arn:aws:artifact:::agreement/agreement-HZTdNwJuqOKLReXC"
]
},
{
"Sid": "DenyCloudWAN",
"Effect": "Deny",
"Action": [
"networkmanager:CreateCoreNetwork",
"networkmanager:CreateConnectAttachment",
"networkmanager:CreateConnectPeer",
"networkmanager:CreateVpcAttachment",
"networkmanager:CreateSiteToSiteVpnAttachment",
"networkmanager:CreateTransitGatewayPeering",
"networkmanager:CreateDirectConnectGatewayAttachment",
"networkmanager:PutCoreNetworkPolicy",
"networkmanager:ExecuteCoreNetworkChangeSet"
],
"Resource": "*"
},
{
"Sid": "DenyTransitGatewayAndVPN",
"Effect": "Deny",
"Action": [
"ec2:CreateTransitGateway",
"ec2:CreateTransitGatewayVpcAttachment",
"ec2:CreateTransitGatewayConnect",
"ec2:CreateTransitGatewayConnectPeer",
"ec2:CreateTransitGatewayMulticastDomain",
"ec2:CreateTransitGatewayPeeringAttachment",
"ec2:CreateTransitGatewayPolicyTable",
"ec2:CreateTransitGatewayPrefixListReference",
"ec2:CreateTransitGatewayRoute",
"ec2:CreateTransitGatewayRouteTable",
"ec2:CreateTransitGatewayRouteTableAnnouncement",
"ec2:CreateClientVpnEndpoint",
"ec2:CreateClientVpnRoute",
"ec2:AuthorizeClientVpnIngress",
"ec2:AssociateClientVpnTargetNetwork",
"ec2:CreateVpnConnection",
"ec2:CreateVpnConnectionRoute",
"ec2:CreateVpnGateway",
"ec2:CreateCustomerGateway"
],
"Resource": "*"
},
{
"Sid": "DenySageMakerGroundTruth",
"Effect": "Deny",
"Action": [
"sagemaker:CreateLabelingJob",
"sagemaker:CreateWorkteam",
"sagemaker:CreateWorkforce",
"sagemaker:CreateHumanTaskUi"
],
"Resource": "*"
},
{
"Sid": "DenyEC2Fleet",
"Effect": "Deny",
"Action": ["ec2:CreateFleet"],
"Resource": "*"
},
{
"Sid": "DenyEC2BYOLAndLicenseConfigurations",
"Effect": "Deny",
"Action": ["ec2:RunInstances", "ec2:StartInstances"],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringEquals": {
"ec2:Tenancy": "host"
}
}
},
{
"Sid": "DenyEC2InstanceStoreRootDevice",
"Effect": "Deny",
"Action": ["ec2:RunInstances"],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringEquals": {
"ec2:RootDeviceType": "instance-store"
}
}
},
{
"Sid": "DenyLicenseManagerAssociation",
"Effect": "Deny",
"Action": ["license-manager:CreateLicenseConfiguration"],
"Resource": "*"
},
{
"Sid": "DenyIAMRestrictedActions",
"Effect": "Deny",
"Action": [
"iam:*Alias*",
"iam:*Organizations*",
"iam:*Provider*",
"iam:SetSecurityTokenServicePreferences",
"iam:*LoginProfile*",
"iam:CreateGroup",
"iam:AttachGroupPolicy",
"iam:AddUserToGroup",
"iam:PutGroupPolicy",
"iam:UpdateGroup",
"iam:UpdateServerCertificate",
"iam:UpdateSigningCertificate",
"iam:UploadServerCertificate",
"iam:UploadSigningCertificate",
"iam:TagServerCertificate",
"iam:UntagServerCertificate"
],
"Resource": "*"
},
{
"Sid": "DenySSOCreateInstance",
"Effect": "Deny",
"Action": ["sso:CreateInstance"],
"Resource": "*"
},
{
"Sid": "DenyRequestSpotInstances",
"Effect": "Deny",
"Action": ["ec2:RequestSpotInstances"],
"Resource": "*"
},
{
"Sid": "DenySpotMarketType",
"Effect": "Deny",
"Action": ["ec2:RunInstances"],
"Resource": "*",
"Condition": {
"StringEquals": {
"ec2:InstanceMarketType": "spot"
}
}
},
{
"Sid": "DenyReservedInstanceAndCapacityPurchases",
"Effect": "Deny",
"Action": [
"athena:CreateCapacityReservation",
"cloudfront:CreateSavingsPlan",
"dynamodb:PurchaseReservedCapacityOfferings",
"ec2:AllocateHosts",
"ec2:CreateCapacityReservation",
"ec2:CreateCapacityReservationBySplitting",
"ec2:CreateCapacityReservationCancellationQuote",
"ec2:CreateCapacityReservationFleet",
"ec2:PurchaseHostReservation",
"ec2:PurchaseReservedInstancesOffering",
"ec2:PurchaseScheduledInstances",
"elasticache:PurchaseReservedCacheNodesOffering",
"es:PurchaseReservedElasticsearchInstanceOffering",
"es:PurchaseReservedInstanceOffering",
"glacier:PurchaseProvisionedCapacity",
"memorydb:PurchaseReservedNodesOffering",
"rds:PurchaseReservedDBInstancesOffering",
"redshift:AcceptReservedNodeExchange",
"redshift:PurchaseReservedNodeOffering",
"sagemaker:CreateReservedCapacity",
"savingsplans:CreateSavingsPlan"
],
"Resource": "*"
},
{
"Sid": "DenyExportableCertificateRequests",
"Effect": "Deny",
"Action": ["acm:RequestCertificate"],
"Resource": "*",
"Condition": {
"StringEquals": {
"acm:AllowExport": "true"
}
}
}
]
}
```
## Resource control policies for projects
The following is the resource control policy for the [resources in the project](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_rcps.html#rcp-supported-services). This policy cannot be modified:
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "DenyAnyoneOutsideMyOrgAndAWS",
"Effect" : "Deny",
"Principal" : "*",
"Action" : [
"aoss:*",
"appconfig:*",
"appstream:*",
"autoscaling:*",
"codebuild:*",
"codecommit:*",
"cognito-identity:*",
"cognito-idp:*",
"comprehend:*",
"comprehendmedical:*",
"dax:*",
"dynamodb:*",
"ecr:*",
"health:*",
"kinesisvideo:*",
"kms:*",
"logs:*",
"s3:*",
"secretsmanager:*",
"sqs:*",
"sts:*",
"support:*",
"textract:*",
"transcribe:*",
"translate:*"
],
"Resource" : "*",
"Condition" : {
"BoolIfExists" : {
"aws:PrincipalIsAWSService" : "false"
},
"Null" : {
"aws:PrincipalARN" : "false"
},
"StringNotEqualsIfExists" : {
"aws:PrincipalOrgID" : "${aws:ResourceOrgID}"
}
}
},
{
"Sid" : "DenyAWSWhenItsNotMyOrgsSourceAccount",
"Effect" : "Deny",
"Principal" : "*",
"Action" : [
"aoss:*",
"appconfig:*",
"appstream:*",
"autoscaling:*",
"codebuild:*",
"codecommit:*",
"cognito-identity:*",
"cognito-idp:*",
"comprehend:*",
"comprehendmedical:*",
"dax:*",
"dynamodb:*",
"ecr:*",
"health:*",
"kinesisvideo:*",
"kms:*",
"logs:*",
"s3:*",
"secretsmanager:*",
"sqs:*",
"sts:*",
"support:*",
"textract:*",
"transcribe:*",
"translate:*"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"aws:SourceAccount" : "false"
},
"StringNotEquals" : {
"aws:SourceOrgID" : "${aws:ResourceOrgID}"
}
}
}
]
}
```