Attach AWS SCP to account that affects existing resources in that account

169 views Asked by At

What happens when you attach a service control policy, let's say that only allows you to launch an EC2 instance of type t2.micro (Action: ec2:RunInstances) but the account it is being attached to already has a t2.large instance running there? Does it prevent the attachment of the SCP or only affects launch of new instances?

1

There are 1 answers

0
luk2302 On

It only prevents launching of new instances. Nothing in any doc would suggest that the SCP would not be able to be applied or that non compliant resources might be removed. Think about it: your SCP might allow operation only by some user or from some VPC or during some time of day. None of those could even be retroactively checked for past compliance.