Organization SCP for Controlling VPC Peering across OUs

Question

Hello

We would like to constrain VPC Peering to stay within an OU.

We created the following SCP:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RestrictVPCPeering",
      "Effect": "Deny",
      "Action": "ec2:CreateVpcPeeringConnection",
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringNotLike": {
          "aws:PrincipalOrgPaths": "o-abcdef/r-1234/ou-1234-abc5678/"
        }
      }
    }
  ]
}
```

I know this SCP is effective, because it does DENY the VPC Peering connection if the Org Path is incorrect.

However, this does NOT work when the Org Path is correct: it still allows cross-OU VPC Peering.
I think the reason is the command is running in **this** OU even though its connecting to a VPC in another OU.

CLI:

```
aws ec2 create-vpc-peering-connection --vpc-id vpc-123456 --peer-vpc-id vpc-987654 --peer-owner-id 1234567890
```

Note: the CLI command is not stopped since its only looking at the invocation of the CLI and not interpreting the arguments.

**Any suggestions on how to prevent cross-OU VPC Peering with Org SCPs?**

Thanks in advance!

Leo K · Answer

The condition key `aws:PrincipalOrgPaths` indicates the OU location of the IAM role, IAM user, or root user that is initiating the creation of the VPC peering connection. It's always local to the account that initiates the creation of the peering connection. This key doesn't reflect the properties of the peering connection, such as the account ID of the VPC being peered with.

The equivalent condition keys that describe the target resources of a request include `aws:ResourceOrgPaths` and `aws:ResourceAccount`. However, It's separately documented that the `ec2:CreateVpcPeeringConnection` permission doesn't support either of those keys, so there's no way to control this particular action based on OU path directly: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceorgpaths.

More complex workarounds could be possible, such as having a Lambda function populate VPCs and the IAM roles that are used to create peering connections with custom resource and principal tags to reflect the OU locations of both the VPCs and IAM roles. An SCP could prevent those tags from being manipulated by untrusted principals. The `ec2:CreateVpcPeeringConnection` permission could then be restricted based on the `ec2:ResourceTag/MyVpcTagKey` or `aws:ResourceTag/MyVpcTagKey` condition key for the VPC, with the other side of the comparison provided as `${aws:PrincipalTag/MyRoleTagKey}` to reference the role's tag as an IAM policy variable: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html.

Documentation doesn't explicitly state whether the `ec2:CreateVpcPeeringConnection` action supports inspecting the resource tags of the target VPC or only the local VPC, but if you want to pursue this more complex avenue, it should be one of the quicker steps to verify.

Organization SCP for Controlling VPC Peering across OUs

Relevant content