RCP Introduction

What Are Resource Control Policies?

Resource control policies (RCPs) are guardrail policies provided by Organizations. They are used to limit the maximum available permission boundaries of resources in an organization. RCPs specify the maximum permissions allowed for resources. All accesses to member accounts' resources within an organization must be restricted by the corresponding RCPs. This helps prevent excessive permissions from being granted at the resource level. You can attach those policies to organizations, OUs, or a single member account. When a policy is attached to an organization or OU, all accesses to the resources of the member accounts within that organization or OU are restricted by the policy. When a policy is attached to a single member account, only the access to that account's resources is restricted.

Helpful links:

• RCP Principles: RCP types, how RCPs work, and the relationship between RCPs and resource policies.
• RCP Syntax: RCP structure and parameters

Testing RCP Effects

Before applying an RCP to your production environment, it is strongly recommended that you use test accounts in a test environment first to perform thorough system design and testing with test cases. This helps avoid any unpleasant surprises in the production environment. You need to fully verify the RCP in the test environment to ensure that the use of service resources is not interrupted unexpectedly.

Tasks Not Restricted by RCPs

You cannot use RCPs to restrict the following tasks:

• RCPs apply only to resources in member accounts within an organization and do not impact resources in the administrator account.
• Tokens obtained by old APIs used for accessing APIs of cloud services that support RCPs (in most cases).

Temporary security credentials obtained by new APIs used for accessing APIs of cloud services that support RCPs are restricted by RCPs.

Helpful Links

For details about the differences in access control between IAM and Organizations, see What Are the Differences in Access Control Between IAM and Organizations?