How to use AWS Resource Control Policies

This post introduces AWS Resource Control Policies (RCPs) as organization-wide guardrails for AWS resource policies, outlines key use cases like enforcing data perimeters, limiting IAM role assumption to approved accounts, constraining OIDC access (e.g., GitHub Actions) to trusted tenants, and preventing external actions on resources such as S3. It contrasts RCPs with SCPs, highlights current service coverage and tooling (e.g., Access Analyzer), and provides guidance for safe, staged deployment and monitoring, noting operational caveats such as generic AccessDenied errors and risks if RCPs are removed.