Modify SCP to enable AWS Config in restricted AWS regions

Question

Hi AWS, I have created an SCP to explicitly deny use of AWS services other than 4 approved AWS regions, i.e. `us-east-1`, `us-east-2`, `us-west-1` and `us-west-2`. Here is the SCP code:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyOtherRegions",
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "us-east-1",
                        "us-east-2",
                        "us-west-1",
                        "us-west-2"
                    ]
                }
            }
        }
    ]
}

```

Now we're planning to enable only AWS config in the non-approved/restricted regions and I have tweaked the original SCP like this:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAllActionsInUSRegions",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:RequestedRegion": [
                        "us-east-1",
                        "us-east-2",
                        "us-west-1",
                        "us-west-2"
                    ]
                }
            }
        },
        {
            "Sid": "DenyAllActionsOutsideUSRegions",
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "us-east-1",
                        "us-east-2",
                        "us-west-1",
                        "us-west-2"
                    ]
                }
            }
        },
        {
            "Sid": "AWSAllConfigGlobally",
            "Effect": "Allow",
            "Action": [
                "config:*"
            ],
            "Resource": "*"
        }
    ]
}
```

Do you think the modified SCP would fulfill the requirement to enable AWS config in all regions or is there something that needs to be identified and fixed. Please advise.

Yaniv Rozenboim · Answer

That wont work because a Deny statement always wins and in your case you deny all actions outside the specified regions including actions related to AWS Config service.

How about you change your original Deny statement to match on all actions except AWS Config related actions by using the `NotAction` key.
Like this:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyOtherRegions",
            "Effect": "Deny",
            "NotAction": "config:*",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "us-east-1",
                        "us-east-2",
                        "us-west-1",
                        "us-west-2"
                    ]
                }
            }
        }
    ]
}
```
**Be sure to thoroughly test this before you use it on production environment.**

I also suggest you take a look at the [Deny region SCP that Control Tower uses](https://docs.aws.amazon.com/controltower/latest/controlreference/primary-region-deny-policy.html). You'll notice that there are multiple actions that are excluded from the regions being denied (among them `config:*`).

Modify SCP to enable AWS Config in restricted AWS regions

Relevant content