c1.2 Select Regions and block the rest

Constrain where resources can be created

Pick the Region(s) your organization uses and deny the rest. Enforce it across all accounts with AWS Organizations Service Control Policies, or, if you use AWS Control Tower, with its Region deny control in the landing zone.

This is a foundational guardrail: it shrinks the attack surface (adversaries often spin up resources in unused Regions to mine crypto or run botnets), keeps data in approved jurisdictions, and reduces the surface you have to monitor. See the related guardrails control for how SCPs fit the broader picture.

Example Region-deny SCP

This policy denies actions outside your approved Regions, while allowing the global services that operate through a specific Region. Adjust the allowed Regions and attach it to an OU (test in non-production first):

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyOutsideApprovedRegions",
    "Effect": "Deny",
    "NotAction": [
      "iam:*", "cloudfront:*", "route53:*",
      "organizations:*", "sts:*", "support:*"
    ],
    "Resource": "*",
    "Condition": {
      "StringNotEquals": {
        "aws:RequestedRegion": ["us-east-1", "eu-west-1"]
      }
    }
  }]
}

Notes

A few global services (such as IAM, CloudFront, and Route 53) operate through a specific Region and should be allowed in your policy. Test Region-deny SCPs in a non-production OU first, since an over-broad deny can block legitimate operations.