AWS Organizations Management Policies Repository

Security Controls

Service Control Policies

Resource Control Policies

Declarative Policies

Tag, Backup & AI Opt-Out Policies

Config Rules

CloudWatch Alarms and Event Rules

CloudFormation Guard Rules

Logging & Monitoring Configurations

Backups & DR

Auto Remediation Rules

Conformance Packs

Billing and Cost Management

S3 Bucket Policies

Security Groups & NACLs

IAM Policies

VPC Endpoint Policies

AWS Services

VPC Security Controls

EC2 Security Controls

IAM Security Controls

S3 Security Controls

RDS Security Controls

OpenSearch/Elasticsearch Security Controls

EFS Security Controls

Route53 Security Controls

Amazon DynamoDB & DAX

ECR Security Controls

EMR Security

Lambda Security

CloudFormation Security

CodeX Security Controls

CloudFront Security

AWS Certificate Manager (ACM) Security

Route53 Resolver Security

Load Balancers & Auto Scaling

RDS Event Subscriptions

AWS Resource Access Manager (RAM)

Application Auto Scaling

Amazon Athena

AWS Batch

AWS Billing Conductor

AWS Clean Rooms

AWS SNS

AWS SQS

AWS Service Discovery

AWS Data Pipeline & Data Sync

AWS Elastic Beanstalk

AWS Fault Injection Simulator

Amazon GameLift

AWS Global Accelerator

Amazon IVS (Interactive Live Streams)

Amazon Kinesis

AWS LakeFormation

Amazon Lookout

Amazon Managed Blockchain

AWS Media Services

AWS Managed Apache Airflow

AWS Resource Explorer

Reference Guides

AWS Account Setup Guide

EC2 Security Strategy

S3 Security Strategy

Logging & Monitoring Strategy Guide

Configuration Packages

A repository of AWS Organizations management policy templates: tag policies to standardize resource tagging, backup policies to enforce organization-wide backup plans, and AI services opt-out policies. Templates can be deployed using CloudFormation, Terraform, or AWS CLI scripts.

AWS (multi-service, tag-supported resources)

Defines a tag policy that requires the CostCenter tag key (exact case) to be one of a fixed set of values, and blocks EC2 resource creation that violates it.

CloudFormationTerraformAWS CLI

AWS Backup (multi-resource)

A backup policy attached at the org root (or a parent OU) that defines a named plan, the Regions it covers, a scheduled rule with a backup window, and tag-based resource selection — a centrally-mandated backup that member accounts cannot opt out of.

CloudFormationTerraformAWS CLI

AWS AI/ML services (multi-service)

Sets an org-root policy that opts every account out of "content used for service improvement" for all current and future AI services, and locks the setting so child OUs and accounts cannot override it.

CloudFormationTerraformAWS CLI

Tag, Backup & AI Opt-Out Policies

AWS (multi-service, tag-supported resources)

Enforce Allowed Values for a Required Cost-Allocation Tag

AWS Backup (multi-resource)

Enforce an Organization-Wide Backup Plan by Resource Tag

AWS AI/ML services (multi-service)

Opt Out of AI Service Content Use by Default, Org-Wide