AWS Launches Resource Control Policies to Standardize Multi-Account Data Perimeters

AWS has expanded AWS Organizations with the launch of Resource Control Policies (RCPs), a new preventative authorization policy type designed to govern the maximum accessible permissions on AWS resources across an enterprise organization. Operating centrally across organizational units (OUs) and member accounts, RCPs support foundational services at launch—including Amazon S3, AWS Key Management Service (AWS KMS), AWS Secrets Manager, AWS Simple Queue Service (Amazon SQS), and AWS STS—enabling security leaders to enforce boundary constraints without modifying individual resource-based policies. Historically, central cloud governance teams relied heavily on Service Control Policies (SCPs) to establish security guardrails. While SCPs effectively restrict principal actions within an organization, they cannot restrict external identities accessing internal resources configured with overly permissive resource policies. RCPs solve this critical asymmetry by evaluating access from the resource perspective. This ensures that even if an account administrator inadvertently opens an S3 bucket or KMS key to external principals, the organization-level RCP overrides and blocks the unintended access path. This development reflects the broader industry shift toward dual-vector zero-trust architectures and data perimeter governance. As enterprise multi-account architectures expand into hundreds or thousands of separate accounts, managing discrete resource-based policies manually becomes unsustainable and error-prone. Modern compliance standards demand automated, declarative policy guardrails that operate independently of local account configurations. By combining identity-focused SCPs with resource-focused RCPs, AWS aligns its governance toolkit with strict perimeter controls required in regulated industries. In practice, cloud platform engineers and governance architects should approach RCP implementation systematically. Because RCPs act as coarse-grained guardrails rather than permission-granting documents, teams must test policies in isolated organizational units before applying them across production trees. Initial rollout efforts should prioritize establishing organization-wide data perimeters—such as restricting S3 access exclusively to requests originating from within corporate IP networks or VPC endpoints. Teams must also account for exceptions, as management accounts and service-linked roles operate outside standard RCP boundaries.