Cloud Docs
Plain-language explanations of the policy constructs and security controls that shape cloud environments, and how they fit together.
- AWS Declarative Policies Explained: A New Way to Lock Down Account SettingsSCPs restrict who can call an API. Declarative policies enforce what state a service stays in. Supported services, syntax, and where teams confuse the two.
- AWS Declarative Policies vs SCPs: What's the Difference?SCPs control what principals can do. Declarative Policies enforce what a service configuration must always look like. Different layers, different jobs.
- AWS IAM Permission Boundaries Explained: What They Do and How to Set Them UpA permissions boundary caps what an IAM role can ever be granted. How the intersection works, and the three steps that close the privilege escalation path.
- AWS RCP Support by Service: What's Covered Today (S3, Control Tower, and More)The 44 AWS service entries that support RCPs today, what each one enforces, which have Control Tower managed controls, and where you still need an SCP instead.
- AWS RCP vs SCP: What's the Difference and Which One Do You Need?SCPs cap what your principals can do. RCPs cap what your resources will accept. The decision framework, the evaluation order, and where teams conflate the two.
- AWS Resource Control Policies (RCPs) Explained: What They Are and How They WorkRCPs are the resource half of an AWS data perimeter. What they control, how they evaluate alongside SCPs and bucket policies, and which services support them.
- AWS Tag Policies and Backup Policies Explained: Governing Resources Across Your OrganizationTag policies standardize tag keys and values across accounts. Backup policies apply backup plans org-wide. What each enforces, and where each one stops.
- AWS Tag Policy vs SCP: Which One Actually Enforces Your Tagging Rules?A tag policy validates the value of a tag you already have. An SCP is what requires the tag to exist. The decision framework and a worked CostCenter scenario.
- Azure Policy Explained: How It Works, With Real Examples and Best PracticesAzure RBAC governs who can request a resource. Azure Policy governs whether its configuration may exist. Scope, effect order, layering, examples, and limits.
- Every Azure Policy Effect Explained: Deny, Audit, Modify, and MoreEvery Azure Policy effect, what each one does, and which two need a managed identity. deny, denyAction, audit, append, modify, and how remediation runs.
- GCP IAM Conditions Explained: Syntax, CEL Examples, and Use CasesMost misconfigured IAM Conditions fail without an error. The CEL attributes that work, examples for time, resource type, and tags, and the traps to avoid.
- GCP IAM Conditions vs Organization Policy: Which Layer Should Enforce the Rule?An IAM Condition binds a rule to one principal. An Organization Policy binds it to a hierarchy node, for everyone. Which layer to use and how to stack them.
- GCP Organization Policy Explained: Constraints, Inheritance, and ExamplesIAM decides who can act on a resource. Organization Policy decides which configurations may exist at all. Boolean and list constraints, inheritance, examples.
- GCP Organization Policy vs IAM: What Each One Actually ControlsIAM decides who can act. Organization Policy decides what the environment permits at all, admins included. The decision framework, and how to layer both.
- How to Create and Manage AWS RCPs with Terraform and the AWS CLIThe console enables the RCP policy type for you. Terraform and the CLI do not, and the attachment still succeeds. The full deployment sequence for both paths.
- How to Deploy AWS Declarative Policies with Terraform and the CLIA tested Terraform and AWS CLI walkthrough: enable the policy type, write the attribute document, attach it, then verify with the account status report.
- How to Set GCP Organization Policies with Terraform and gcloudgoogle_org_policy_policy is the current resource, and enforce takes a string, not a boolean. Writing, importing, and auditing org policies in Terraform.
- Permission Boundaries vs SCPs: How They Differ and When to Use EachAn SCP caps an entire account or OU. A permission boundary caps one IAM role or user inside it. How the two interact, plus a decision framework and a scenario.
- Permission Boundary vs IAM Policy: What Actually Controls AccessAn IAM policy grants access. A permission boundary caps what any policy can grant. Effective permissions are the intersection. Which one to reach for, and when.
- VPC Service Controls Explained: How Google Cloud Perimeters Actually WorkIAM governs who can reach a resource. VPC Service Controls governs which perimeter a request may cross. Building a perimeter, dry run, bridges, ingress rules.