# [[AWS Accounts and Organizations including Service Control Policies (SCPs)## SCPs "deny" will override any higher up "allow" permissions. So even though an allow permission will cascade down through all Org Units, any explicit deny will also cascade and override allow.## You can choose your own strategy. By default an Organization will have the '''FullAWSAccess''' SCP attached to it and every OU and account. This is the 'Deny List Strategy' because you must override the 'default' allow full access with deny rules. On the other hand, you can remove (delete) this SCP and then you would have an 'Allow List Strategy' because you would need to specifically list each service you want to allow in the Organizations, OUs and Accounts. ## AWS Control Tower allows you to setup and govern multi-account environments. ]]
# [[Identity Management and Permissions including RBAC, ABAC and permissions boundaries]]
# AWS Directory Services and Federation including Identity Federation, AWS SSO, and Cognito