cis-aws-foundations-2-1-2

name	cis-aws-foundations-2.1.2
description	Ensure authorization guardrails for all AWS Organization accounts
category	cis-iam
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","iam","organizations","scp","rcp","guardrails","authorization"]
cis_id	2.1.2
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-2.1.1","cis-aws-foundations-2.1.4"]
prerequisites	[]
severity_boost	{}

Ensure authorization guardrails for all AWS Organization accounts

Description

Ensure that one or more baseline authorization policies such as Service Control Policies (SCPs) and/or Resource Control Policies (RCPs) are attached to all member accounts in AWS Organizations in accordance with organizational security requirements. Authorization policies act as preventive permission guardrails: SCPs define the maximum available permissions for IAM principals within accounts, while RCPs define the maximum available permissions for resources within accounts. These policies can enforce security invariants such as preventing disabling of key security services, restricting use of unapproved AWS Regions, or blocking external access to sensitive resources.

Rationale

Authorization policies do not grant permissions but instead set organization-wide limits on what actions principals can perform (SCPs) and what access can be granted to resources (RCPs), regardless of local IAM or resource-based policies. Without baseline guardrail authorization policies, each account can grant excessive or inconsistent permissions that disable logging, weaken security services, allow use of unapproved Regions and services, or permit unintended external access to resources. Attaching standard authorization policies to all member accounts enforces preventive, centralized control over high-risk actions and access patterns, supports least-privilege and role-based access control at scale, and helps ensure that all accounts and resources operate within the organization's defined security baseline.

Impact

Enforcing baseline authorization policies for all member accounts can initially block some existing patterns, such as use of unapproved Regions, disabling security services, or granting broader permissions than the guardrails allow. Teams may need to adjust IAM policies, deployment pipelines, and exception processes so legitimate use cases remain possible within the new guardrails. This can introduce short-term operational overhead and require careful testing, especially when attaching new policies at the root or OU level.

Audit Procedure

Using AWS CLI

Pre-requisite: you must run these CLI commands in the management account for the AWS Organization.

1. Before auditing, document or confirm your organization's baseline guardrail requirements. Common examples include:

   • Prevent disabling CloudTrail, AWS Config, GuardDuty, or Security Hub
   • Restrict usage to approved AWS Regions only
   • Protect central security or logging roles from modification
   • Deny external principal access to sensitive resources

2. List all SCPs and RCPs in the organization:

aws organizations list-policies --filter SERVICE_CONTROL_POLICY
aws organizations list-policies --filter RESOURCE_CONTROL_POLICY