Cloud landing zones
Test a denied deployment before a team needs an exception
A platform control should fail clearly and preserve a usable recovery path. Exercise both legitimate restrictions and accidental policy conflicts.
In this article
Choose a specific prohibited action
Use a safe test environment and attempt an operation the baseline intentionally disallows, such as creating a resource outside an approved location or enabling an unsupported public access path.
State the expected reason for denial before running the test. A failure caused by a missing unrelated permission does not prove the intended control works.
Capture the caller identity, action and relevant policy scope without exposing credentials.
Inspect what the team can understand
Review the error returned to the deployment pipeline. Can the workload team identify the restriction and find the relevant guidance, or does it receive only a generic access-denied message?
Check whether any resources were created before the failure. Partial deployments may need cleanup or a safe rerun path.
The test should verify that the team can recover using its normal authority. Requiring a platform administrator to manually repair every denied deployment makes the control expensive to operate.
Test an allowed deployment beside it
Run the compliant version of the same workload. This distinguishes a useful boundary from a policy that blocks the entire capability.
Include inherited policies and identity permissions in the diagnosis. In AWS, service control policies constrain available permissions but do not grant access by themselves. An allowed action still needs the appropriate permission path.
Avoid resolving the test by broadly disabling governance. Narrow the conflicting rule or correct the workload configuration under the intended exception process.
Exercise the exception lifecycle
Create a synthetic, time-limited exception request with an owner, reason and scope. Verify how it is approved, applied, observed and removed under the organisation's process.
Test expiry or withdrawal while the workload exists. The platform needs to explain whether existing resources remain, future changes are blocked or remediation is required.
Record the complete outcome in the platform's acceptance evidence. The control is ready when it blocks the intended action, permits the supported alternative and gives teams a practical way to resolve legitimate edge cases.
Primary sources
AWS: service control policiesReferences checked 11 September 2026.