IAM, Accounts, & Organizations

Question 1

What are Service Control Policies (SPCs)?

Answer 1

They are account permission boundaries and limit what accounts can do, and therefore what users can do inside that account, including the account’s root user.

Question 2

Are there any accounts that are unaffected by SCPs?

Answer 2

Yes - the management account of an AWS Organization will be unaffected by any SCPs.