I am at the stage of learning how to write cross account terraform. have 2 organizations (main, sandbox). I do all my current real work in main. I want to set up an service control policy that will prevent anyone from making expensive resources in the sandbox account I don’t really use frequently

I think this should prevent anyone from making expensive resources should something get compromised.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyResources",
      "Effect": "Deny",
      "Action": [
        "ec2:Create*",
        "lambda:Create*",
        "s3:CreateBucket",
        "dynamodb:CreateTable",
        "cloudfront:CreateDistribution",
        "rds:CreateDBInstance"
      ],
      "Resource": "*"
    }
  ]
}

am I missing anything?
I am still reading up on how to make an SCP. Any recommendations to make it easier?