AWS controltower: Clarify not to modify/detach Control Tower-created SCPs

Service: controltower · 2026-09-27 · Documentation medium

File: controltower/latest/userguide/orgs-guidance.md · Type: iam

Summary

Reworded guidance to state that modifying or detaching the SCPs AWS Control Tower creates for a registered OU can put controls into an unknown state, and to create new SCPs instead.

Security assessment

SCPs are organization-level permission guardrails; the change strengthens guidance against weakening or removing these controls, which could otherwise broaden permissions across accounts. It is best-practice hardening guidance, not a fix for a specific vulnerability.

Evidence

  * Do not modify or detach the service control policies (SCPs) that AWS Control Tower creates for a registered OU. Modifying or detaching these SCPs can cause the controls to enter an unknown state. If that happens, you must reset your landing zone or re-register your OU in AWS Control Tower. Instead, use AWS Organizations to create new SCPs and attach them to the OU.

Diff

diff --git a/controltower/latest/userguide/orgs-guidance.md b/controltower/latest/userguide/orgs-guidance.md
index 1d35955b2..3159066cf 100644
--- a//controltower/latest/userguide/orgs-guidance.md
+++ b//controltower/latest/userguide/orgs-guidance.md
@@ -17 +17 @@ AWS Control Tower is closely associated with AWS Organizations. Here is some spe
-  * Do not update existing service control policies (SCPs) attached to an OU that is registered with AWS Control Tower. Doing so could result in the controls entering an unknown state, which will require you to reset your landing zone or re-register your OU in AWS Control Tower. Instead, you can use AWS Organizations to create new SCPs and attach those to the OUs rather than editing the SCPs that AWS Control Tower has created.
+  * Do not modify or detach the service control policies (SCPs) that AWS Control Tower creates for a registered OU. Modifying or detaching these SCPs can cause the controls to enter an unknown state. If that happens, you must reset your landing zone or re-register your OU in AWS Control Tower. Instead, use AWS Organizations to create new SCPs and attach them to the OU.