Service Control Policies use the exact same JSON shape as an ordinary IAM identity policy — Version, Statement, Effect, Action, Resource, Condition — which is precisely what makes them easy to misunderstand. Service Control Policy Generator reuses the same statement-building and validation engine as this site's other IAM policy tools, because the document shape genuinely is identical, but the UI and the copy around it are built to correct the misunderstanding that shared shape invites: an SCP does not grant anything, ever, on its own.
An SCP attached to an AWS Organizations account or organizational unit sets the maximum permissions available inside that account or OU. It is a ceiling, not a floor. A statement reading {"Effect":"Allow","Action":"*","Resource":"*"} inside an SCP grants precisely nothing by itself — every principal in the account still needs its own IAM identity-based or resource-based policy actually allowing whatever it wants to do, and the SCP only decides whether that IAM policy's grant is permitted to take effect at all. This is the single fact most likely to be misunderstood by anyone new to SCPs, and it is the reason this tool does not offer a generic Allow-statement builder the way the ordinary policy tools do.
What SCPs are genuinely, reliably useful for is the opposite: explicit Deny statements that set a hard ceiling no IAM policy anywhere in the account — no matter how permissive, no matter who wrote it — can override. Deny always wins in AWS's policy evaluation logic, and an SCP Deny cannot be overridden by an Allow anywhere else, including in another SCP. That is why this tool leads with three curated, genuinely common Deny templates rather than an open-ended builder. Deny actions outside an approved region list uses a Deny on Action:"*", Resource:"*" with a StringNotEquals condition on aws:RequestedRegion — a standard data-residency and cost-control guardrail that blocks every API call outside your chosen region list, regardless of what any account's own IAM policies say. Deny leaving the organization blocks organizations:LeaveOrganization outright, preventing an account from being detached from central governance. Deny disabling logging blocks cloudtrail:StopLogging, cloudtrail:DeleteTrail, and config:DeleteConfigurationRecorder, closing off the most direct ways an account could silently turn off its own audit trail before doing something it does not want logged.
Templates can be combined — add more than one, and they accumulate into a single Statement array in one document, since a real SCP commonly bundles several unrelated guardrails together.
The size check gets its own dedicated, correctly-labeled treatment rather than reusing the shared policy-size helper used elsewhere on this site. That shared helper reports against IAM's own quotas — 6,144 characters for a managed policy, 10,240 for a role's inline policies, 2,048 for a user's, 5,120 for a group's — none of which is the actual SCP quota, even though one of them happens to share the same number by coincidence. AWS Organizations SCPs have their own, separate 5,120-character limit, and this tool checks against that real limit specifically, under its own label, rather than reusing an IAM-policy-quota name that would misdescribe what is actually being measured. As with AWS's own measurement convention, the check strips whitespace before comparing against the limit — a pretty-printed document is not actually larger for quota purposes than its minified form, and both counts are shown so the difference is visible.
Structural validation is the same check used across this tool category: Version present and recognized, Statement non-empty, and each statement carrying a valid Effect, Action, and Resource. It does not additionally check organization-wide constraints AWS enforces outside a single document, such as the maximum number of SCPs attachable to one account or OU. Everything — template assembly, size checking, and validation — runs locally in your browser; nothing about your organization structure or account IDs is required or collected.