Which AWS policy type specifies the maximum resource permissions for in organization or organizational unit (OU)?

Service Control Policies (SCPs) are a feature of AWS Organizations used to manage permissions centrally. They define the maximum permissions available to IAM users and roles within an account, an Organizational Unit (OU), or the entire organization. SCPs act as "guardrails," ensuring that accounts stay within the organization's access control guidelines. They do not grant permissions themselves but rather specify the upper boundary of actions that can be delegated by identity-based or resource-based policies within an account.

A. Resource: Resource-based policies are attached directly to a resource (e.g., an S3 bucket) and define who can access that specific resource, not maximum permissions for an OU.
B. Permission Boundaries: A permissions boundary sets the maximum permissions for a specific IAM entity (a user or role), not for an entire account, OU, or organization.
C. Session: Session policies are temporary policies passed during a programmatic session (e.g., an assumed role) to limit permissions for that specific session only.

1. AWS Organizations User Guide. "Service control policies (SCPs)." AWS Documentation. Accessed May 2024. In the "Service control policies (SCPs)" section, it states, "SCPs are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in your organization."

2. AWS Identity and Access Management User Guide. "Permissions boundaries for IAM entities." AWS Documentation. Accessed May 2024. This section clarifies, "A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity (user or role)."

3. AWS Identity and Access Management User Guide. "Policy types." AWS Documentation. Accessed May 2024. This page defines the different policy types, stating that "Resource-based policies are attached to a resource" and "Session policies are policies that you pass in a parameter when you programmatically create a temporary session for a role or federated user."