AWS shows how to enforce approved post-quantum signing algorithms with SCPs and IAM
AWS published a follow-up security guide explaining how organizations can enforce which ML-DSA (post-quantum signature) parameter sets are allowed across their AWS environment. It covers using Service Control Policies (SCPs) at the organization or OU level and IAM permission boundaries to block creation and use of non-approved ML-DSA variants (e.g., blocking ML-DSA-44 while allowing ML-DSA-65/87). The guide also covers AWS Private CA and certificate controls, and discusses the trade-off between deny-lists (default-allow for new variants) and allow-lists (default-deny, requiring policy updates for new approved algorithms).