* 15. AWS Control Tower
* 16. [HOL] Create a Landing Zone
SCPs "deny" will override any higher up "allow" permissions. So even though an allow permission will cascade down through all Org Units, any explicit deny will also cascade and override allow.
You can choose your own strategy. By default an Organization will have the '''FullAWSAccess''' SCP attached to it and every OU and account. This is the 'Deny List Strategy' because you must override the 'default' allow full access with deny rules. On the other hand, you can remove (delete) this SCP and then you would have an 'Allow List Strategy' because you would need to specifically list each service you want to allow in the Organizations, OUs and Accounts.
AWS '''Control Tower''' allows you to setup and govern multi-account environments.
[[Category:AWS]]