How to Check an SCP Deny List in Python

Load a JSON SCP policy file, extract the deny_list, and check if a target ARN is denied.

Easy Python 3.9+ Aug 9, 2026 Cloud + Python 14 views 0 copies

aws scp json policies cloud

Python code

30 lines

Python 3.9+

import json
from pathlib import Path


def evaluate_scp_deny_list(policy_path: Path, target_path: str) -> bool:
    policy = json.loads(policy_path.read_text())
    deny_list = policy.get("deny_list", [])
    return target_path in deny_list


if __name__ == "__main__":
    policy_file = Path("scp_policy.json")
    policy_file.write_text(
        json.dumps({
            "deny_list": [
                "arn:aws:s3:::confidential-bucket/*",
                "arn:aws:s3:::internal-only/*",
            ]
        })
    )

    test_targets = [
        "arn:aws:s3:::confidential-bucket/data.docx",
        "arn:aws:s3:::public-bucket/index.html",
        "arn:aws:s3:::internal-only/notes.txt",
    ]

    for target in test_targets:
        result = evaluate_scp_deny_list(policy_file, target)
        print(f"{target} -> {'DENIED' if result else 'ALLOWED'}")

Output

stdout

arn:aws:s3:::confidential-bucket/data.docx -> DENIED
arn:aws:s3:::public-bucket/index.html -> ALLOWED
arn:aws:s3:::internal-only/notes.txt -> DENIED

How it works

The code reads the JSON policy from a file using Path.read_text, then parses it with json.loads. It uses .get("deny_list", []) to safely retrieve the list, defaulting to an empty list if the key is missing. The target ARN is checked with the in operator, which works because deny_list is a list of strings. This pattern is simple and effective for mock evaluations of SCP restrictions.

Common mistakes

Assuming the policy JSON always has a deny_list key without using .get()
Using json.load instead of json.loads on a file object
Forgetting to handle file not found errors when reading the policy

Variations

Use a set for deny_list to speed up lookups on large lists
Load the policy from an environment variable string instead of a file

Real-world use cases

Testing SCP configurations in CI/CD pipelines before deployment to AWS.
Validating access control rules in infrastructure-as-code tools like Terraform.
Mocking policy checks in unit tests for IAM or S3 access logic.

How to Check an SCP Deny List in Python

Python code

Output

How it works

Common mistakes

Variations

Real-world use cases

More from Cloud + Python

Tutorials

Quizzes

Python code

Output

How it works

Common mistakes

Variations

Real-world use cases

More from Cloud + Python

Keep learning

Tutorials

Quizzes