AWS Resource Control Policy (RCP)

AWS Resource Control Policies are the newer, resource-side counterpart to SCPs: instead of restricting what a principal can do, an RCP limits what actions can be performed on a resource, including requests from external principals, the account root user, and AWS service principals.

An SCP caps what a principal is allowed to do; an RCP caps what a resource will accept, regardless of who's asking. In practice, an SCP can constrain the actions principals in your organization can take, while an RCP provides an organization-level resource-side boundary that can restrict access even when identity-based or resource-based policies would otherwise allow it.

SCPs and RCPs evaluate independently, and both have to allow a request for it to succeed – so mature AWS environments typically layer both: SCPs to constrain which actions identities can take, RCPs to put a hard floor under what actions resources will accept, even when identity-based or resource-based policies would otherwise allow them. Together they close the gap that either control alone would leave open.

The AWS Organizations console and CLI let you write and attach SCPs and RCPs directly, but they don't simulate impact, manage exceptions, or keep policies consistent as your account structure grows. Aryon adds that layer with a continuously maintained library of security policies, centrally managed enforcement through SCPs and RCPs, impact testing before enforcement, and tracked, auditable exceptions.

Blocking a misconfiguration before deployment means the check happens at the point the API request is made to AWS, using preventive controls such as SCPs or RCPs that AWS evaluates and enforces natively at the control plane. Because enforcement happens at the cloud control plane, the same misconfiguration is blocked regardless of whether it was attempted through Terraform, the console, the CLI, or an AI agent.