AWS re:Post을(를) 사용하면 다음에 동의하게 됩니다. AWS re:Post 이용 약관
AWS re:Postre:Post

SCP policy to deny all actions on specific tag based resources

0

Hi, I'm trying to create a SCP to prevent users from modifying specific resources based on a specific tag. This is the policy I've applied, but I can still modify name, tags and other on the different resources that should be restricted.

"Sid": "DenyAllActionsOnControlTowerTaggedRessources", "Effect": "Deny", "Action": [ "" ], "Resource": [ "" ], "Condition": { "StringLike": { "aws:ResourceTag/cloudformation:stack-name": ["StackSet-AWSControlTower*"] }

I'm hoping from some advice. Thank you.

주제
관리 및 거버넌스
태그
태깅서비스 제어 정책
언어
English
RoxTeo
질문됨 8달 전969회 조회
1개 답변
0

Hi RoxTeo.

I think the problem might be with how you defined the policy. I'm not sure if you were redacting the policy, but actions and resources should have an asterisk (*) if you want to include all actions/resources.

{
    "Version": "2012-10-17",
    "Statement": [
        {
             "Sid": "DenyAllActionsOnControlTowerTaggedRessources", 
             "Effect": "Deny", 
             "Action": "*", 
             "Resource": "*", 
             "Condition": { 
                   "StringLike": { 
                         "aws:ResourceTag/cloudformation:stack-name": ["StackSet-AWSControlTower*"] 
                   }
             }
         }
}

Here are some examples of SCPs with tags. Also note that using StringLike will cause the condition to do case-sensitive evaluations. Per the documentation:

StringLike Case-sensitive matching. The values can include multi-character match wildcards (*) and single-character match wildcards (?) anywhere in the string. You must specify wildcards to achieve partial string matches.

Note If a key contains multiple values, StringLike can be qualified with set operators—ForAllValues:StringLike and ForAnyValue:StringLike. For more information, see Multivalued context keys.

I hope this helps.

profile pictureAWS
전문가
Jose Guay
답변함 8달 전
  • RoxTeo
    8달 전

    Hi Jose,

    Thank you very much for the reply. Indeed, something happed with the policy while editing the message. My policy looks exactly like the one you posted and it's part of bigger one also denying other operations on the account. For the StringLike condition, the tag starts with "StackSet-AWSControlTower" and then the is a random string.

    Shouldn't this policy deny all action (e.g. name change of the ressource etc) on the identified resources?

    Thank you!

  • Bobk
    7달 전

    I have a similar problem. I want to restrict and role, except for a specified one with wildcards, not to be able to provision, update or terminate service catalogue products, where the product being launched has a tagkey = environment and a tagvalue = prod, any other value should be allowed. With the below policy, I have tried both "ResourceTag" and RequestTag", also for the principal, I have tried "ArnNotLIke". I can only get prevent the creation, but it can still update and terminate existing provisioned products.

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "cloudformation:*",
        "servicecatalog:UpdateProvisionedProduct",
        "servicecatalog:TerminateProvisionedProduct"
      ],
      "Resource": [
        "arn:aws:cloudformation:*:*:stack/SC*",
        "arn:aws:servicecatalog:*:*:stack/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/environment": "prod"
        },
        "StringNotLike": {
          "aws:PrincipalARN": [
            "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_administrators*"
          ]
        }
      }
    }
  ]
}

    When using the "ResourceTag" option, I also get a warning about this problem. https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-reference-policy-checks.html#access-analyzer-reference-policy-checks-security-warning-deny-with-unsupported-tag-condition-key-for-service

    Any ideas?

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠