World map

 

BM

World A2: Keys & Guards

Permission boundaries and SCPs

You will learn: the two fences that limit keys, and why a fence never opens a door by itself.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

The site bucket’s own policy says the CI role may upload. But the role has a fence that only allows ECR. Predict.

Read the request and its policies. Will AWS say Allow or Deny?

The request

Who
ci-deployer (role session)arn:aws:sts::111122223333:assumed-role/ci-deployer/run-42
Wants to
s3:PutObject
On
arn:aws:s3:::kedai-site/index.html
Resource policy (the unit's sign) · kedai-site
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/ci-deployer"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::kedai-site/*"
}
]
}
Permissions boundary (fence) · ecr-only
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ecr:*",
"Resource": "*"
}
]
}
Your guess:

Watch

That fence is a permissions boundary: A fence around one user or role. They can never do more than it allows, whatever else says yes.: the most one user or role may ever do. An SCP (service control policy): A fence around whole accounts in an organization. It never grants keys; it only limits them. is a fence around whole accounts. Sort the facts.

Drag a card into a box. Or tap the card, then tap the box.

      Try it

      Fences limit. Keys open. True, or needs work?

      Swipe right for good, left for needs work. Or use the buttons.

      1 / 4

      A boundary alone lets a role read S3.

      Predict

      Your organization’s SCP allows s3:*. Aina has no IAM policy for S3. Can she read the menu bucket?

      Check

      The shop’s accounts must stay in the Malaysia Region. An SCP at the root enforces it. Aina uploads to a bucket in us-east-1. Predict.

      Read the request and its policies. Will AWS say Allow or Deny?

      The request

      Who
      Aina (IAM user)arn:aws:iam::111122223333:user/aina
      Wants to
      s3:PutObject
      On
      arn:aws:s3:::kedai-backup/today.json
      Request facts
      aws:RequestedRegion = us-east-1
      Identity policy (key ring) · menu-writer
      {
      "Version": "2012-10-17",
      "Statement": [
      {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::kedai-*"
      }
      ]
      }
      SCP at root (mall owner's rule) · FullAWSAccess
      {
      "Version": "2012-10-17",
      "Statement": [
      {
      "Effect": "Allow",
      "Action": "*",
      "Resource": "*"
      }
      ]
      }
      SCP at root (mall owner's rule) · malaysia-only
      {
      "Version": "2012-10-17",
      "Statement": [
      {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
      "StringNotEquals": {
      "aws:RequestedRegion": "ap-southeast-5"
      }
      }
      }
      ]
      }
      Your guess:

      You did it!

      You can now tell keys from fences, and predict when a fence says no.

      Go deeper (optional)

      Where the story breaks: a metal key opens its lock forever. AWS checks every request fresh, against every key and fence at once. And a robot can borrow a key for just minutes.

      Real SCPs often exempt global services from a Region rule. Read the SCP examples in the Organizations guide before you write one.