Check ID: organizations_opt_out_ai_services_policy
Provider: AWS
Service: organizations
Severity: MEDIUM
Categories: gen-ai
Resource type: Other

​
What this check verifies

AWS Organizations is assessed for an AI services opt-out policy that sets services.default.opt_out_policy to optOut and blocks child overrides via @@operators_allowed_for_child_policies set to @@none.

​
Risk

Without an enforced opt-out, AI services may store and use your content for model training, weakening confidentiality and data sovereignty. If child accounts can override, they can re-enable data use, risking unintended cross-Region retention and exposure of logs, documents, or code processed by these services.

​
Recommendation

Establish an org-wide AI services opt-out: set the default to optOut and prohibit child policy overrides (@@none). Apply at the highest scope, gate exceptions through change control, and review periodically. Align with least privilege and data minimization to prevent unintended content sharing with managed AI services.

​
Remediation

# Enable AI services opt-out policy type
resource "aws_organizations_organization" "<example_resource_name>" {
  enabled_policy_types = ["AISERVICES_OPT_OUT_POLICY"]  # Critical: allow AI opt-out policies
}

# Create the AI opt-out policy
resource "aws_organizations_policy" "<example_resource_name>" {
  name    = "<example_resource_name>"
  type    = "AISERVICES_OPT_OUT_POLICY"
  content = <<JSON
{ "services": { "default": { "opt_out_policy": { "@@assign": "optOut", "@@operators_allowed_for_child_policies": ["@@none"] } } } }
JSON
  # Critical: @@assign "optOut" opts out; @@operators... ["@@none"] prevents child overrides
}

# Attach policy to the org root
resource "aws_organizations_policy_attachment" "<example_resource_name>" {
  policy_id = aws_organizations_policy.<example_resource_name>.id
  target_id = aws_organizations_organization.<example_resource_name>.roots[0].id  # Critical: attach to root
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = organizations_opt_out_ai_services_policy. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks