title: AWS SCP policies - combining statements
body: <p>There's a limit on assigning SCP policies on Root/OUs and to save resources I'm trying to combine 2-3 policy statements together into one SCP, but this doesn't seem to work.</p>
  <p>Does anyone have an example of how it is done in their 'organization'?</p>
  <p><em>e.g. with terraform (but the json is the important part not the creation method)</em>:</p>
  <pre><code>resource &quot;aws_organizations_policy&quot; &quot;Allowed_EC2_AND_ES_InstanceTypes&quot; {
      name = &quot;Allowed_EC2_AND_ES_InstanceTypes&quot;
      type = &quot;SERVICE_CONTROL_POLICY&quot; 
      description = &quot;Policy that defines which EC2 and ES Instance Types are allowed (applied via terraform)&quot;
      tags = {&quot;purpose&quot;: &quot;limit EC2-ES family types&quot;}
      content = &lt;&lt;CONTENT
  {
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement1&quot;: [
          {
              &quot;Sid&quot;: &quot;Statement1&quot;,
              &quot;Effect&quot;: &quot;Deny&quot;,
              &quot;Action&quot;: [&quot;ec2:RunInstances&quot;],
              &quot;Resource&quot;: [&quot;arn:aws:ec2:*:*:instance/*&quot;],
              &quot;Condition&quot;: {
                  &quot;StringNotLike&quot;: {
                      &quot;ec2:InstanceType&quot;: [
                      &quot;t3.*&quot;,
                      &quot;m5.*&quot;,
                      &quot;r5.*&quot;,
                      &quot;c5.*&quot;,
                      &quot;m6i.*&quot;
                    ]
                  }
              }
            }
          ],
      &quot;Statement2&quot;: [
          {
              &quot;Sid&quot;: &quot;Statement2&quot;,
              &quot;Effect&quot;: &quot;Deny&quot;,
              &quot;Action&quot;: [
                  &quot;es:CreateDomain&quot;,
                  &quot;es:CreateElasticsearchDomain&quot;
                  ],
              &quot;Resource&quot;: [
                  &quot;*&quot;
                  ],
              &quot;Condition&quot;: {
                  &quot;ForAnyValue:StringEquals&quot;: {
                  &quot;aws:PrincipalType&quot;: [
                      &quot;t2.*&quot;,
                      &quot;c4.*&quot;,
                      &quot;m3.*&quot;,
                      &quot;m4.*&quot;,
                      &quot;r3.*&quot;,
                      &quot;r4.*&quot;
                ]
             }
          }
        }
     ] 
  }
  CONTENT
  }
  
  </code></pre>
  <p>Many thanks in advance!</p>