Restrict AWS Management Console access to expected networks with sign-in resource-based policies and RCPs

This article explains how to restrict AWS Management Console access to expected networks using sign-in resource-based policies and resource control policies (RCPs).

• Create resource permission statements specifying corporate IP ranges, VPCs, and excluded principals for console access
• Enable console authorization configuration to enforce the resource-based policy on your account
• Verify implementation through CloudTrail events showing successful and denied sign-in attempts
• Scale across multiple accounts using RCPs attached at organization, OU, or account level
• Combine with AWS Management Console Private Access to create comprehensive data perimeter controls
• Available at no additional cost in all AWS commercial Regions

Sign-in resource-based policies and RCPs enable organizations to enforce network perimeter controls for console access, supporting regulatory compliance and security requirements.