Help Center/ Organizations/ FAQs/ What Are the Differences in Access Control Between IAM and Organizations?
Updated on 2026-07-24 GMT+08:00
View PDF
Share

What Are the Differences in Access Control Between IAM and Organizations?

  1. They control different entities. IAM policies define permissions for IAM users, user groups, and agencies within an account. SCPs specify the maximum available permissions for IAM identities in a member account. RCPs specify the maximum available permissions for resources in an organization. NCPs specify the maximum available permissions for VPC endpoints in an organization.
  2. Their permission scopes are distinct but interdependent. Even if IAM policies grant certain actions to a user, those actions are blocked if denied by an SCP, RCP, or NCP. Granted permissions take effect only if they are also permitted by the applicable SCPs, RCPs, and NCPs.
  3. SCPs, RCPs, and NCPs restrict permissions but do not grant them. They define the upper boundary of available permissions for IAM identities and resources in an organization. To grant permissions, use IAM policies for IAM users, user groups, and agencies.