IAM SCP Root Restriction Generator

The AWS account root user has full, unrestrictable access by default and cannot be limited with an ordinary IAM policy — root has no attached identity policy to constrain in the first place. The widely-documented mitigation is an AWS Organizations Service Control Policy (SCP) that explicitly denies a curated set of high-risk actions specifically when the calling principal is root, using the condition pattern AWS itself documents for this purpose: "Condition": {"StringLike": {"aws:PrincipalArn": "arn:aws:iam::*:root"}} combined with "Effect": "Deny". IAM SCP Root Restriction Generator builds exactly that document from a checklist of common root-restriction targets, without requiring you to hand-write the condition syntax correctly yourself.

This tool is deliberately narrower than a general-purpose SCP builder: every statement it produces targets root specifically via the aws:PrincipalArn condition, so IAM users and roles in the account are unaffected by these Deny statements and can continue performing the listed actions through their own IAM permissions as normal — only the root user is blocked. The checklist covers seven commonly recommended root-restriction targets: all IAM changes (creating/deleting users, roles, policies, groups, and attaching policies), creating root access keys, billing and payment method changes, closing the account or leaving the organization (account:CloseAccount / organizations:LeaveOrganization), disabling CloudTrail logging, changing the root password, and changing the AWS Support plan. Toggle whichever subset applies to your organization's policy and the tool assembles them into one SCP document.

This must be attached at the AWS Organizations level — not as a regular IAM policy. The JSON shape happens to look identical to an ordinary IAM policy, which is exactly what makes this mistake easy to make: pasting this document into IAM as a customer-managed or inline policy does nothing to restrict root, because IAM policies are never evaluated against the root user's actions at all. It only takes effect when attached, through AWS Organizations, to the organization root, an organizational unit, or an individual member account — and even then, only accounts that are actually members of an AWS Organization are affected. A standalone AWS account with no Organization has no SCP evaluation layer at all, so this generator's output would have no effect if applied outside Organizations.

The size check runs against the real, separate 5,120-character AWS Organizations SCP quota (not any of the IAM policy size limits used elsewhere on this site), measured the way AWS actually measures it — excluding whitespace.

• Root-specific Deny pattern using the documented aws:PrincipalArn StringLike condition against arn:aws:iam::*:root.
• 7-item curated checklist of common root-restriction targets, toggle any subset.
• Explicit, visible warning that this must be attached via AWS Organizations, never as a plain IAM policy.
• Correct, SCP-specific 5,120-character limit check, not a mislabeled IAM policy quota.
• Built on the same statement/document engine as this site's other policy tools.
• Copy as JSON and Download .json.
• 100% client-side.

1. Check the root-restriction targets you want denied (IAM changes, access keys, billing, account closure, disabling logging, password changes, support plan).
2. Click Build SCP.
3. Review the generated Deny statements and the character count against the 5,120 SCP limit.
4. Copy or download the JSON.
5. Attach it in AWS Organizations — to the org root, an OU, or a specific account — never as a regular IAM policy.

Example 1 — minimal root lockdown. Check only "Deny creating root access keys" and "Deny root account closure" — a small 2-statement SCP well under the size limit.

Example 2 — comprehensive. Check all seven items — a multi-statement SCP covering IAM changes, access keys, billing, closure, logging, password, and support plan, all scoped to root only.

Example 3 — the common mistake this tool warns against. Pasting the generated JSON into an IAM user's permissions instead of attaching it via AWS Organizations — the tool's own banner calls this out explicitly, since it is a silent no-op rather than an error.

• Uses the real AWS-documented root-restriction condition pattern, not an approximation.
• Curated, genuinely common targets instead of an open-ended builder.
• Loud warning against the most common deployment mistake (attaching as a plain IAM policy).
• Correct SCP-specific size limit, separate from IAM policy quotas.
• Distinct from the general SCP Generator — purpose-built for root restriction.
• Private — runs entirely in your browser.