Service Control Policy

SCPs limit covered AWS principals without granting access. Resource-policy grants and principal identity determine which restrictions apply.