AWS Organizations SCP should declare a root-user denial

What it checks

Organizations SCP: this declaration does not demonstrate a supported full root-user denial statement.

Where it applies

Terraform: aws_organizations_policy

CloudFormation: AWS::Organizations::Policy

How to fix it

1. Review this policy declaration and its deliberate exceptions. If intended, manually add a Deny statement with Action and Resource "*" and Condition {"ArnLike":{"aws:PrincipalArn":"arn:aws:iam::*:root"}}, preserving existing statements. Resolve unread inputs before editing; verify attachments and effective permissions separately.

Frameworks

• SOC 2 CC6.1

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules