If you’re testing IAM Access Analyzer Internal Access with an S3 bucket in one account and IAM roles in another account within the same AWS Organization, you might run into some confusion about how Service Control Policies (SCPs) work. Here’s a simple guide to help clear things up.
Suppose you attach an SCP to an organizational unit (OU) that denies actions like s3:DeleteObject and s3:DeleteObjectVersion. During testing, you’ll notice that when you try to delete an object in S3, the action fails with an “Access Denied” message, confirming that the SCP is working and properly enforced. You can see that actions like s3:PutObject still succeed, which indicates the deny rules are active.
Now, here’s where it gets tricky. When you look at the Internal Access Analyzer findings, you’ll see a status like serviceControlPolicyRestriction = APPLIED. This means the SCP was taken into account. However, surprisingly, some findings still show the s3:DeleteObject action even though the SCP is supposed to deny it.
So, is this normal? Yes, it’s expected behavior. The APPLIED status just means that the SCP was considered during the analysis, but it doesn’t automatically hide or remove actions that are still listed in findings. SCPs are used to limit permissions at a high level, but the detailed analysis might still show all actions attempted or involved, regardless of deny rules.
Unfortunately, AWS doesn’t clearly state this in the documentation, especially for SCPs, in the same way they do for Resource Control Policies (RCPs). The key takeaway is that APPLIED means the SCP impacted the decision, but the presence of actions in the findings doesn’t necessarily mean they are allowed—it might just show what was involved during the operation.
In summary, if you see that the SCP is marked as APPLIED but some deny actions are still present in the findings, don’t worry. The deny is enforced, and the findings are simply showing all attempted actions, not what’s allowed. Just keep this in mind when reviewing results from Access Analyzer.