11{
2- "Version" :" 2012-10-17"
3- "Statement" :[
4- {
5- "Sid" :" EnforceNetworkPerimeterSourceVPC"
6- "Effect" :" Deny"
7- "Principal" :" *"
8- "Action" :[
9- " sqs:*"
10- " secretsmanager:*"
11- " sts:AssumeRole"
12- " sts:DecodeAuthorizationMessage"
13- " sts:GetAccessKeyInfo"
14- " sts:GetFederationToken"
15- " sts:GetServiceBearerToken"
16- " sts:GetSessionToken"
17- " sts:SetContext"
18- " aoss:*"
19- " ecr:*"
20- ],
21- "Resource" :" *"
22- "Condition" :{
23- "NotIpAddressIfExists" :{
24- "aws:SourceIp" :" <my-corporate-cidr>"
25- },
26- "StringNotEqualsIfExists" :{
27- "aws:SourceVpc" :" <my-vpc>"
28- "aws:PrincipalTag/dp:exclude:network" :" true"
29- "aws:PrincipalAccount" :[
30- " <load-balancing-account-id>"
31- " <fin-space-account-id>"
32- " <third-party-account-a>"
33- " <third-party-account-b>"
34- ],
35- "aws:ResourceTag/dp:exclude:network" :" true"
36- },
37- "BoolIfExists" :{
38- "aws:PrincipalIsAWSService" :" false"
39- "aws:ViaAWSService" :" false"
40- },
41- "ArnNotLikeIfExists" :{
42- "aws:PrincipalArn" :[
43- " arn:aws:iam::*:role/aws:ec2-infrastructure"
44- ]
45- },
46- "StringEquals" :{
47- "aws:PrincipalTag/dp:include:network" :" true"
48- }
49- }
50- },
51- {
52- "Sid" :" SourceVPCRegion"
53- "Effect" :" Deny"
54- "Action" :" *"
55- "Resource" :" *"
56- "Condition" :{
57- "StringEquals" :{
58- "aws:SourceVpc" :" <my-vpc-in-this-region>"
59- },
60- "StringNotEqualsIfExists" :{
61- "aws:RequestedRegion" :" <my-vpc-region>"
62- }
63- }
64- },
65- {
66- "Sid" :" SourceVPCRegion2"
67- "Effect" :" Deny"
68- "Action" :" *"
69- "Resource" :" *"
70- "Condition" :{
71- "StringEquals" :{
72- "aws:SourceVpc" :" <my-vpc-in-this-region>"
73- },
74- "StringNotEqualsIfExists" :{
75- "aws:RequestedRegion" :" <my-vpc-region-2>"
76- }
77- }
2+ "Version" : " 2012-10-17"
3+ "Statement" : [
4+ {
5+ "Sid" : " EnforceNetworkPerimeterSourceVPC"
6+ "Effect" : " Deny"
7+ "Principal" : " *"
8+ "Action" : [
9+ " sqs:*"
10+ " secretsmanager:*"
11+ " sts:AssumeRole"
12+ " sts:DecodeAuthorizationMessage"
13+ " sts:GetAccessKeyInfo"
14+ " sts:GetFederationToken"
15+ " sts:GetServiceBearerToken"
16+ " sts:GetSessionToken"
17+ " sts:SetContext"
18+ " aoss:*"
19+ " ecr:*"
20+ ],
21+ "Resource" : " *"
22+ "Condition" : {
23+ "NotIpAddressIfExists" : {
24+ "aws:SourceIp" : " <my-corporate-cidr>"
25+ },
26+ "StringNotEqualsIfExists" : {
27+ "aws:SourceVpc" : " <my-vpc>"
28+ "aws:PrincipalTag/dp:exclude:network" : " true"
29+ "aws:PrincipalAccount" : [
30+ " <load-balancing-account-id>"
31+ " <fin-space-account-id>"
32+ " <third-party-account-a>"
33+ " <third-party-account-b>"
34+ ],
35+ "aws:ResourceTag/dp:exclude:network" : " true"
36+ },
37+ "BoolIfExists" : {
38+ "aws:PrincipalIsAWSService" : " false"
39+ "aws:ViaAWSService" : " false"
40+ },
41+ "ArnNotLikeIfExists" : {
42+ "aws:PrincipalArn" : [
43+ " arn:aws:iam::*:role/aws:ec2-infrastructure"
44+ ]
45+ },
46+ "StringEquals" : {
47+ "aws:PrincipalTag/dp:include:network" : " true"
48+ }
7849 }
79- ]
80- }
50+ },
51+ {
52+ "Sid" : " SourceVPCRegion"
53+ "Effect" : " Deny"
54+ "Principal" : " *"
55+ "Action" : [
56+ " sqs:*"
57+ " secretsmanager:*"
58+ " sts:AssumeRole"
59+ " sts:DecodeAuthorizationMessage"
60+ " sts:GetAccessKeyInfo"
61+ " sts:GetFederationToken"
62+ " sts:GetServiceBearerToken"
63+ " sts:GetSessionToken"
64+ " sts:SetContext"
65+ " aoss:*"
66+ " ecr:*"
67+ ],
68+ "Resource" : " *"
69+ "Condition" : {
70+ "StringEquals" : {
71+ "aws:SourceVpc" : " <my-vpc-in-this-region>"
72+ },
73+ "StringNotEqualsIfExists" : {
74+ "aws:RequestedRegion" : " <my-vpc-region>"
75+ }
76+ }
77+ },
78+ {
79+ "Sid" : " SourceVPCRegion2"
80+ "Effect" : " Deny"
81+ "Principal" : " *"
82+ "Action" : [
83+ " sqs:*"
84+ " secretsmanager:*"
85+ " sts:AssumeRole"
86+ " sts:DecodeAuthorizationMessage"
87+ " sts:GetAccessKeyInfo"
88+ " sts:GetFederationToken"
89+ " sts:GetServiceBearerToken"
90+ " sts:GetSessionToken"
91+ " sts:SetContext"
92+ " aoss:*"
93+ " ecr:*"
94+ ],
95+ "Resource" : " *"
96+ "Condition" : {
97+ "StringEquals" : {
98+ "aws:SourceVpc" : " <my-vpc-in-this-region>"
99+ },
100+ "StringNotEqualsIfExists" : {
101+ "aws:RequestedRegion" : " <my-vpc-region-2>"
102+ }
103+ }
104+ }
105+ ]
106+ }
0 commit comments