JA EN
shiichan

AWS Organizations Now Ships Default Guardrails Blocking New Accounts From Leaving!

AWS What's New ★★ View Markdown
#aws#security#devops

Hi, it's Shii! Today I found some AWS Organizations governance news that's low-key but really important, so let me share it with you!

AWS What's New aws.amazon.com

What was announced?

According to AWS's official "What's New" post, when you create a new Organization from the AWS Organizations console, AWS now automatically applies service control policies (SCPs) that block member accounts from leaving the organization or closing themselves.

Specifically, the built-in SCPs block these two actions:

  • A member account leaving the organization
  • A member account closing itself

Here are the regions where this is available right now:

  • US East (N. Virginia)
  • AWS GovCloud (US-East)
  • AWS GovCloud (US-West)
  • China (Beijing)
  • China (Ningxia)

Why it matters

When you're running a multi-account setup, there's always some risk that someone accidentally removes an account from the organization or closes it. Until now, you had to build and apply your own SCPs to guard against that. This is especially helpful for enterprises migrating to AWS or teams starting a brand-new organization, since you get a baseline of protection from day one, even without deep security expertise.

What changes

Any new Organization you create from the console now comes with this SCP already in place, so you're protected against accidental account departures or self-closures right from the start. The default is intentionally lightweight so it doesn't get in the way of normal operations, and administrators can still modify or disable it freely whenever they need to. You get a safe baseline without having to design the policy yourself.

Wrap-up

  • New Organizations created via the console now automatically get SCPs that block account departure and self-closure
  • Available in US East (N. Virginia), AWS GovCloud (US-East/US-West), and China (Beijing/Ningxia)
  • The default is lightweight, and admins can change or disable it anytime
  • Especially useful for enterprises migrating to AWS or teams standing up a brand-new organization

Related posts