Check ID: organizations_scp_check_deny_regions
Provider: AWS
Service: organizations
Severity: HIGH
Categories: identity-access
Resource type: Other

​
What this check verifies

AWS Organizations SCPs limit account actions to approved regions using conditions on aws:RequestedRegion. This evaluates whether policies exist and fully restrict access to the configured allowlist, rather than only some regions.

​
Risk

Without comprehensive Region limits, users or attackers can deploy resources in ungoverned locations, bypassing monitoring and guardrails. Impacts:
  • Data outside approved jurisdictions (confidentiality)
  • Policy gaps and drift (integrity)
  • IR blind spots and unexpected cost (availability)

​
Recommendation

Enforce Region governance with SCPs that allow only approved regions via aws:RequestedRegion conditions (deny-by-default). Apply across relevant OUs and accounts, with narrow exceptions for required global services. Review often; align to least privilege, data residency, and continuous monitoring.

​
Remediation

# Terraform: SCP denying requests outside approved regions
resource "aws_organizations_policy" "<example_resource_name>" {
  name = "<example_resource_name>"
  type = "SERVICE_CONTROL_POLICY"
  content = jsonencode({
    Version   = "2012-10-17"
    Statement = [
      {
        Effect   = "Deny"
        Action   = "*"
        Resource = "*"
        Condition = {
          StringNotEquals = {
            "aws:RequestedRegion" = ["<REGION_1>", "<REGION_2>"] # Critical: only these regions are allowed; others are denied
          }
        }
      }
    ]
  })
}

resource "aws_organizations_policy_attachment" "<example_resource_name>" {
  policy_id = aws_organizations_policy.<example_resource_name>.id
  target_id = "<example_resource_id>" # Critical: attach to the root (r-xxxx), OU (ou-xxxx), or account ID
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = organizations_scp_check_deny_regions. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks