1. Lock the org to GovCloud regions (SCP)
Write an AWS Organizations Service Control Policy that DENIES every action when the request is NOT in an approved GovCloud region. Use one statement: • Effect: "Deny" • Action: "*" • Resource: "*" • Condition: StringNotEquals on "aws:RequestedRegion" listing "us-gov-west-1" and "us-gov-east-1"
An SCP is an org-wide guardrail that sets the MAXIMUM permissions for accounts — no user or role can exceed it. To pin workloads to GovCloud, you Deny all actions when `aws:RequestedRegion` is NOT one of your approved regions (StringNotEquals). Because it's a Deny with a NotEquals condition, anything outside the list is blocked. (Global services like IAM are region-less; a real policy adds a NotAction exception for those — omitted here for the core shape.)