Service Control Policy

An AWS Organizations policy that sets the maximum permissions for every account under an organizational unit or the whole organization. It never grants access on its own; it only blocks, for example forbidding use of a region in all production accounts. Why it matters: It is a guardrail no single account can override, useful for blocking costly services or regions.