AWS Organizations in Production: SCPs and Control Tower

Updated 5 November 2026 · Standard formula, shown below

In production, AWS Organizations is the account hierarchy and policy boundary; service control policies (SCPs) set the maximum permissions available to accounts, while AWS Control Tower helps establish and govern a multi-account landing zone. Use SCPs for carefully tested organization-wide guardrails and Control Tower for standardized account setup and governance—not as substitutes for identity permissions, workload controls, or operational review.

How Organizations, SCPs, and Control Tower fit together

AWS Organizations groups accounts into an organization, with a management account at its root and optional organizational units (OUs) beneath it. An OU is a container for accounts that share governance needs, such as production workloads, development, security, or a sandbox. The hierarchy lets administrators apply policies at the root, an OU, or an individual account.

An SCP is a permissions guardrail, not a grant of access. It defines which actions principals in member accounts can potentially use, but it does not give a user or role permission to perform them. An action must also be allowed by the applicable identity-based or resource-based permissions and must pass other relevant authorization checks. SCPs do not apply to principals in the Organizations management account, so that account needs separate protection.

Control Tower is a service for setting up and governing a multi-account AWS environment called a landing zone. It uses Organizations and other AWS services to establish a structure, controls, and account provisioning workflows. Its preventive controls can use SCPs; detective controls use monitoring and detection mechanisms. The exact control implementation and available options depend on the control and the landing-zone configuration.

Designing a production OU structure

Organize accounts around meaningful differences in risk, ownership, or operating requirements—not simply around teams or the company chart. A useful structure makes it clear where policies apply and who is responsible for exceptions.

Keep foundational accounts distinct. Common examples include security or audit functions, centralized logging, and shared infrastructure. Limit routine workload activity in these accounts.
Separate production from nonproduction. This supports different access, change, and data-handling guardrails. Keep development and test accounts from inheriting permissions or assumptions intended for production.
Use OUs to express policy boundaries. For example, an organization might have Production and Nonproduction OUs, with separate Sandbox and Security areas. The right layout depends on the controls each group actually needs.
Keep the hierarchy understandable. A deeply nested OU tree can make inherited policy behavior difficult to reason about. Document each OU’s purpose and the accounts assigned to it.

There is no single AWS-prescribed OU design that suits every organization. Start with a small number of boundaries that correspond to distinct requirements, then split an OU when a real policy or administrative difference justifies it. Moving an account can change the SCPs and other OU-level governance it inherits, so treat moves as controlled changes.

How SCP evaluation works

For a principal in a member account, applicable SCPs constrain the maximum permissions available as policies are inherited through the organization hierarchy. A permission must survive the relevant SCP restrictions and also be allowed by the policies that grant access. In practical terms, an SCP cannot make an otherwise unauthorized action work; it can prevent an action that identity policies would otherwise allow.

SCPs are commonly written using either an allow-list or a deny-list approach. With an allow-list, administrators explicitly allow the actions that accounts may use; because an action needs an applicable allow, omissions can block services unexpectedly. With a deny-list, permissions are generally available subject to other authorization policies, and explicit denies block selected actions. AWS Organizations documentation describes the policy types and inheritance rules; review those rules for the organization’s current configuration before designing exceptions.

For example, a deny rule can block disabling a required security service across workload accounts. That does not automatically ensure the service is configured correctly, nor does it grant security staff permission to manage it. The relevant roles, service setup, and monitoring still need to be designed separately. Also, do not assume an SCP’s effect on member accounts applies to the management account.

Using Control Tower in a live environment

Control Tower can help standardize account enrollment, baseline governance, and ongoing checks. Its landing-zone configuration and registered OUs matter: an account or OU that is not governed as expected may not receive the intended controls. Confirm account enrollment and control status rather than assuming that every account in the organization is automatically governed.

Before enabling a preventive control, inspect the SCP or policy behavior it introduces and assess how it interacts with existing policies. A control that blocks changes to organization-wide security settings may be appropriate for production yet disruptive to a deployment pipeline or recovery procedure unless the required path is planned. Detective controls can identify drift or noncompliance, but a finding is not itself a prevention mechanism.

Control Tower and direct Organizations changes must be managed with care. Avoid making out-of-band changes to resources or configuration that Control Tower expects to manage without first checking the service’s guidance and the effect on landing-zone drift. Keep a record of approved customizations, and establish who owns updates when AWS changes or adds controls.

Common production pitfalls and safer rollout

Using SCPs as permission grants: An SCP does not grant access. Pair guardrails with role design and identity policies.
Applying a broad deny too early: A deny can affect administrators, automation, incident response, or account recovery. Test the precise actions and principals involved.
Forgetting inheritance: Policies attached at higher levels can affect many accounts. Review the effective combination of policies before changing the root or a shared OU.
Assuming exceptions are simple: An allow in a lower-level policy does not override an explicit deny inherited from above. Design exceptions deliberately and validate them against the applicable policy rules.
Overlooking service-linked roles and service behavior: Some AWS services use service-linked roles, and SCP behavior has specific rules and exceptions. Check the current documentation for the service and action rather than assuming a generic role test covers it.
Ignoring the management account: SCPs do not restrict its principals. Restrict access to that account through separate identity, authentication, monitoring, and operational controls.

A safer rollout is to inventory accounts and critical workflows, write the intended policy effect in plain language, and test it in a nonproduction OU. Validate ordinary deployments, security operations, backups, and recovery workflows. Then apply the policy to a limited production scope, monitor for denied actions, and expand only after owners confirm expected behavior. Keep a tested rollback or recovery plan; do not rely on an administrator action that the new policy might also block.

Choosing a structure and governance approach

Organizations without a need for Control Tower can manage accounts and SCPs directly through AWS Organizations and use other services or internal processes for account provisioning and compliance monitoring. Control Tower is useful when its landing-zone workflows and controls match operational needs, but it adds configuration and lifecycle considerations. It does not remove the need to understand Organizations, IAM, or the behavior of each control.

For either approach, assign clear ownership for the management account, OU policies, Control Tower configuration, and exceptions. Track policy changes through review and testing, and check AWS documentation when behavior depends on a particular service or control. Production governance is strongest when preventive rules, detective signals, access grants, and incident procedures work together.

Frequently Asked Questions

Do SCPs grant permissions to users or roles?
No. SCPs set the maximum permissions available to principals in member accounts; identity-based or resource-based policies and other authorization requirements must still allow the action.

Can an SCP restrict the AWS Organizations management account?
No. SCPs do not apply to principals in the management account. Protect it with separate access controls and operational safeguards.

Should production and development accounts be in separate OUs?
Often, if they need different guardrails or access practices. The separation is useful when it creates a meaningful policy boundary, not merely because the account names differ.

Does Control Tower automatically govern every organization account?
Do not assume so. Verify that accounts are enrolled and their OUs are governed as intended, then check the status of the controls that matter.

Can an OU-level allow override a deny inherited from the root?
No. An explicit deny that applies through the hierarchy is not canceled by a lower-level allow. Review the full policy evaluation and inheritance before relying on an exception.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.