Can Lambda edit SCP or IAM policy

[bhanuC]

IS IT A BEST PRACTICE TO CREATE A NEW SCP FOR AN ACCOUNT THAT DENIES LAUNCHING ANY NEW INFRASTRUCTURE OR ADD A POLICY TO THE IAM GROUP (FOR THE ACCOUNT) TO DENY LAUNCHING ANY NEW INFRASTRUCTURE. ALSO CAN LAMBDA DO BOTH THESE ACTIONS?

[Carlo-TutorialsDojo]

Hello bhanuC,

May I know what’s the use case for this? SCPs are only applicable for accounts under an Organization. To answer your question about whether Lambda can edit SCP or IAM policy, I’m pretty sure it can be done via the IAM/Organizations APIs.

Regards,

Carlo @ Tutorials Dojo