Skip to content

Commit 7e78b78

Browse files
tatyatsktatyatsk
committed
Expanding service-specific guidance to include 16 additional services
1 parent ece3aa2 commit 7e78b78

24 files changed

Lines changed: 1636 additions & 11 deletions

‎service_control_policies/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ Example data access patterns:
160160
* [Amazon DocumentDB cluster snapshots](https://docs.aws.amazon.com/documentdb/latest/developerguide/backup_restore-share_cluster_snapshots.html ): You can share an Amazon Document DB manual cluster snapshot with other accounts or make them public with the `ModifyDBClusterSnapshotAttribute` API.
161161
* [Amazon WorkSpaces image](https://docs.aws.amazon.com/workspaces/latest/adminguide/share-custom-image.html): You can share custom WorkSpaces images with other accounts with the `UpdateWorkspaceImagePermission` API.
162162
* [Amazon CloudWatch sink](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account.html): You can share observability data with other accounts with the `CreateLink` API.
163-
* [AWS Service Catalog portfolio](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/catalogs_portfolios_sharing.html): AWS Service Catalog portfolios can be shared with other AWS accounts with the `CreatePortfolioShare` API.
163+
* [AWS Service Catalog portfolio](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/catalogs_portfolios_sharing.html): AWS Service Catalog portfolios can be shared with other AWS accounts with the `CreatePortfolioShare` and `UpdatePortfolioShare` APIs.
164164
* [AWS Config aggregator](https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html): The `PutConfigurationAggregator` API allows you to select another account to add to your AWS Config aggregator. Additionally, the `PutAggregationAuthorization` API allows you to authorize another account to collect data from your account.
165165
* [AWS Fault Injection experiment template](https://docs.aws.amazon.com/fis/latest/userguide/multi-account.html): You create a multi-account experiment template by specifying other accounts with the `CreateTargetAccountConfiguration` API.
166166
* [AWS Global Accelerator attachment](https://docs.aws.amazon.com/global-accelerator/latest/dg/cross-account-resources.create-attachment.html): You can add a resource from another account as an endpoint for an accelerator with the `CreateCrossAccountAttachment` API.

‎service_control_policies/data_perimeter_governance_scp.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@
4949
"workspaces:UpdateWorkspaceImagePermission",
5050
"oam:CreateLink",
5151
"servicecatalog:CreatePortfolioShare",
52+
"servicecatalog:UpdatePortfolioShare",
5253
"config:PutConfigurationAggregator",
5354
"config:PutAggregationAuthorization",
5455
"fis:CreateTargetAccountConfiguration",

‎service_control_policies/service_specific_controls/README.md‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -92,11 +92,11 @@ Additional considerations:
9292

9393
This statement is included in the [restrict_idp_configurations_scp](restrict_idp_configurations_scp.json) and prevents users from making configuration changes to the IAM SAML [identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html), IAM OIDC [identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html), and [AWS IAM Roles Anywhere](https://aws.amazon.com/iam/roles-anywhere/) [trust anchors](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/getting-started.html). It also prevents creation of an [account instance of IAM Identity Center]( https://docs.aws.amazon.com/singlesignon/latest/userguide/account-instances-identity-center.html).
9494

95-
### "Sid":"PreventDeploymentCodeStarConnections"
95+
### "Sid":"PreventDeploymentCodeStarConnections", "Sid": "PreventDeploymentSSMAutomationRunbook"
9696

97-
This statement is included in the [restrict_nonvpc_deployment_scp](restrict_nonvpc_deployment_scp.json) and limits the use of [AWS CodeStar Connections](https://docs.aws.amazon.com/codestar-connections/latest/APIReference/Welcome.html).
97+
These statements are included in the [restrict_nonvpc_deployment_scp](restrict_nonvpc_deployment_scp.json) and limit the use of [AWS CodeStar Connections](https://docs.aws.amazon.com/codestar-connections/latest/APIReference/Welcome.html) and [AWS Systems Manager Automation](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-automation.html).
9898

99-
AWS services such as AWS CodeStar Connections do not support deployment within a VPC and provide direct access to the internet that is not controlled by your VPC. You can block the use of such services by using SCPs or implementing your own proxy solution to inspect egress traffic.
99+
AWS services such as AWS Systems Manager Automation do not support deployment within a VPC and provide direct access to the internet that is not controlled by your VPC. You can block the use of such services by using SCPs or implementing your own proxy solution to inspect egress traffic.
100100

101101
### "Sid":"PreventNonVPCDeploymentSageMaker", "Sid":"PreventNonVPCDeploymentGlueJob", "Sid":"PreventNonVPCDeploymentCloudShell", "Sid":"PreventNonVPCDeploymentLambda", "Sid":"PreventNonVPCDeploymentAppRunner", and "Sid":"PreventNonVPCDeploymentCodeBuild"
102102

@@ -120,10 +120,18 @@ For more details, see [Connect a Notebook Instance in a VPC to External Resource
120120

121121
This statement is included in the [restrict_untrusted_endpoints_scp](restrict_untrusted_endpoints_scp.json) and prevents users from subscribing email addresses that belong to domains other than the one denoted by `<trusted_email_domain>` to an SNS topic. See [Amazon SNS policy keys](https://docs.aws.amazon.com/sns/latest/dg/sns-using-identity-based-policies.html#sns-policy-keys) for more details.
122122

123+
### "Sid": "PreventEventBridgeAPIDestinations"
124+
125+
This statement is included in the [restrict_untrusted_endpoints_scp](restrict_untrusted_endpoints_scp.json) and prevents users from using API destinations as the target for an event bus rule. See [Using IAM policy conditions in Amazon EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-use-conditions.html#limiting-access-to-targets) for more details.
126+
127+
### "Sid": "PreventUntrustedStepFunctionsHTTPSAPI"
128+
129+
This statement is included in the [restrict_untrusted_endpoints_scp](restrict_untrusted_endpoints_scp.json) and prevents Step Functions from invoking HTTPS APIs that don't belong to your organization. See [IAM permissions to run an HTTP Task](https://docs.aws.amazon.com/step-functions/latest/dg/call-https-apis.html#connect-http-task-permissions) for more details.
130+
123131
### "Sid": "PreventCreationOfServicePresignedURL"
124132

125133
This statement is included in the [restrict_presignedURL_scp](restrict_presignedURL_scp.json) and prevents users from making API requests that return Amazon S3 presigned URLs that are presigned by a service principal.
126134

127135
### "Sid": "PreventResourcePolicyConfigurations"
128136

129-
This statement is included in the [restrict_resource_policy_configurations_scp](restrict_resource_policy_configurations_scp.json) and prevents users from configuring resource-based policies for select services.
137+
This statement is included in the [restrict_resource_policy_configurations_scp](restrict_resource_policy_configurations_scp.json) and prevents users from configuring resource-based policies for services that are not yet supported by RCPs. See the AWS Organizations User Guide for the [List of AWS services that support RCPs](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_rcps.html#rcp-supported-services).

‎service_control_policies/service_specific_controls/restrict_nonvpc_deployment_scp.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,19 @@
11
{
22
"Version": "2012-10-17",
33
"Statement": [
4+
{
5+
"Sid": "PreventDeploymentSSMAutomationRunbook",
6+
"Effect": "Deny",
7+
"Action": [
8+
"ssm:StartAutomationExecution"
9+
],
10+
"Resource": "*",
11+
"Condition": {
12+
"StringNotEqualsIfExists": {
13+
"aws:PrincipalTag/dp:exclude": "true"
14+
}
15+
}
16+
},
417
{
518
"Sid": "PreventDeploymentCodeStarConnections",
619
"Effect": "Deny",

‎service_control_policies/service_specific_controls/restrict_presignedURL_scp.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@
55
"Sid": "PreventCreationOfServicePresignedURL",
66
"Effect": "Deny",
77
"Action": [
8-
"lambda:GetFunction"
8+
"ecr:GetDownloadUrlForLayer",
9+
"lambda:GetFunction",
10+
"ssm:GetDeployablePatchSnapshotForInstance"
911
],
1012
"Resource": "*",
1113
"Condition": {

‎service_control_policies/service_specific_controls/restrict_resource_policy_configurations_scp.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
"codeartifact:PutDomainPermissionsPolicy",
1010
"codebuild:PutResourcePolicy",
1111
"dynamodb:PutResourcePolicy",
12+
"events:PutPermission",
1213
"glacier:SetVaultAccessPolicy",
1314
"lambda:AddLayerVersionPermission",
1415
"lambda:AddPermission",

‎service_control_policies/service_specific_controls/restrict_untrusted_endpoints_scp.json‎

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,38 @@
1919
"aws:PrincipalTag/dp:exclude:resource": "true"
2020
}
2121
}
22+
},
23+
{
24+
"Sid": "PreventEventBridgeAPIDestinations",
25+
"Effect": "Deny",
26+
"Action": [
27+
"events:PutTargets"
28+
],
29+
"Resource": "*",
30+
"Condition": {
31+
"ForAnyValue:ArnLike": {
32+
"events:TargetArn": "arn:aws:events:*:*:api-destination/*"
33+
},
34+
"StringNotEqualsIfExists": {
35+
"aws:PrincipalTag/dp:exclude:resource": "true"
36+
}
37+
}
38+
},
39+
{
40+
"Sid": "PreventUntrustedStepFunctionsHTTPSAPI",
41+
"Effect": "Deny",
42+
"Action": [
43+
"states:InvokeHTTPEndpoint"
44+
],
45+
"Resource": "*",
46+
"Condition": {
47+
"StringNotLike": {
48+
"states:HTTPEndpoint": "<trusted_https_endpoint>"
49+
},
50+
"StringNotEqualsIfExists": {
51+
"aws:PrincipalTag/dp:exclude:resource": "true"
52+
}
53+
}
2254
}
2355
]
24-
}
56+
}

‎service_specific_guidance/backup-specific-guidance.md‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
# Service-specific guidance: AWS Backup
2+
3+
4+
This document outlines service-specific guidance for implementing a data perimeter for AWS Backup.
5+
6+
7+
AWS Backup is a fully managed backup service that simplifies and centralizes the backup of data across AWS services, including Amazon EBS volumes, Amazon RDS databases, Amazon DynamoDB tables, Amazon EFS file systems, and more. It provides a unified way to create, manage, and automate backup policies, ensuring data protection and compliance with regulatory requirements.
8+
9+
10+
The following table specifies whether additional considerations apply to a specific data perimeter control objective, followed by the list of considerations and recommended controls, if any.
11+
12+
| Perimeter type | Security objective | Applied on | Policy type | Additional considerations |
13+
|----------------|-------------------|------------|-------------|------------------------|
14+
| Identity perimeter | Only trusted identities can access my resources | Resource | RCP | N |
15+
| Identity perimeter | Only trusted identities are allowed from my network | Network | VPC endpoint policy | N |
16+
| Resource perimeter | My identities can access only trusted resources | Identity | SCP | N |
17+
| Resource perimeter | Only trusted resources can be accessed from my network | Network | VPC endpoint policy | N |
18+
| Network perimeter | My identities can access resources only from expected networks | Identity | SCP | N |
19+
| Network perimeter | My resources can be accessed only from expected networks | Resource | RCP | N |
20+
21+
*Y – Additional considerations apply. N – No additional considerations apply.
22+
23+
24+
**List of service APIs reviewed against data perimeter control objectives**
25+
* CancelLegalHold
26+
* CreateBackupPlan
27+
* CreateBackupSelection
28+
* CreateBackupVault
29+
* CreateFramework
30+
* CreateLegalHold
31+
* CreateLogicallyAirGappedBackupVault
32+
* CreateReportPlan
33+
* CreateRestoreTestingPlan
34+
* CreateRestoreTestingSelection
35+
* DeleteBackupPlan
36+
* DeleteBackupSelection
37+
* DeleteBackupVault
38+
* DeleteBackupVaultAccessPolicy
39+
* DeleteBackupVaultLockConfiguration
40+
* DeleteBackupVaultNotifications
41+
* DeleteFramework
42+
* DeleteRecoveryPoint
43+
* DeleteReportPlan
44+
* DeleteRestoreTestingPlan
45+
* DeleteRestoreTestingSelection
46+
* DescribeBackupJob
47+
* DescribeBackupVault
48+
* DescribeCopyJob
49+
* DescribeFramework
50+
* DescribeGlobalSettings
51+
* DescribeProtectedResource
52+
* DescribeRecoveryPoint
53+
* DescribeRegionSettings
54+
* DescribeReportJob
55+
* DescribeReportPlan
56+
* DescribeRestoreJob
57+
* ExportBackupPlanTemplate
58+
* GetBackupPlan
59+
* GetBackupPlanFromJSON
60+
* GetBackupPlanFromTemplate
61+
* GetBackupSelection
62+
* GetBackupVaultAccessPolicy
63+
* GetBackupVaultNotifications
64+
* GetLegalHold
65+
* GetRecoveryPointRestoreMetadata
66+
* GetRestoreJobMetadata
67+
* GetRestoreTestingInferredMetadata
68+
* GetRestoreTestingPlan
69+
* GetRestoreTestingSelection
70+
* GetSupportedResourceTypes
71+
* ListBackupJobs
72+
* ListBackupJobSummaries
73+
* ListBackupPlans
74+
* ListBackupPlanTemplates
75+
* ListBackupPlanVersions
76+
* ListBackupSelections
77+
* ListBackupVaults
78+
* ListCopyJobs
79+
* ListCopyJobSummaries
80+
* ListFrameworks
81+
* ListLegalHolds
82+
* ListProtectedResources
83+
* ListProtectedResourcesByBackupVault
84+
* ListRecoveryPointsByBackupVault
85+
* ListRecoveryPointsByLegalHold
86+
* ListRecoveryPointsByResource
87+
* ListReportJobs
88+
* ListReportPlans
89+
* ListRestoreJobs
90+
* ListRestoreJobsByProtectedResource
91+
* ListRestoreJobSummaries
92+
* ListRestoreTestingPlans
93+
* ListRestoreTestingSelections
94+
* ListTags
95+
* PutBackupVaultAccessPolicy
96+
* PutBackupVaultLockConfiguration
97+
* PutBackupVaultNotifications
98+
* PutRestoreValidationResult
99+
* StartBackupJob
100+
* StartCopyJob
101+
* StartReportJob
102+
* StartRestoreJob
103+
* TagResource
104+
* UntagResource
105+
* UpdateBackupPlan
106+
* UpdateFramework
107+
* UpdateGlobalSettings
108+
* UpdateRecoveryPointLifecycle
109+
* UpdateRegionSettings
110+
* UpdateReportPlan
111+
* UpdateRestoreTestingPlan
112+
* UpdateRestoreTestingSelection

‎service_specific_guidance/cloudfront-keyvaluestore-specific-guidance.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
2+
# Data perimeter accelerator
3+
4+
5+
This document outlines service-specific guidance for implementing a data perimeter for Amazon CloudFront KeyValue Store.
6+
7+
Amazon CloudFront KeyValue Store is a feature of Amazon CloudFront that allows you to store and retrieve small amounts of data with low latency at CloudFront edge locations. It enables you to enhance your web applications by storing and accessing frequently used data closer to your users, improving performance and reducing the load on your origin servers.
8+
9+
10+
The following table specifies whether additional considerations apply to a specific data perimeter control objective, followed by the list of considerations and recommended controls, if any.
11+
12+
| Perimeter type | Security objective | Applied on | Policy type | Additional considerations |
13+
|----------------|-------------------|------------|-------------|------------------------|
14+
| Identity perimeter | Only trusted identities can access my resources | Resource | RCP | N |
15+
| Identity perimeter | Only trusted identities are allowed from my network | Network | VPC endpoint policy | Y |
16+
| Resource perimeter | My identities can access only trusted resources | Identity | SCP | N |
17+
| Resource perimeter | Only trusted resources can be accessed from my network | Network | VPC endpoint policy | Y |
18+
| Network perimeter | My identities can access resources only from expected networks | Identity | SCP | N |
19+
| Network perimeter | My resources can be accessed only from expected networks | Resource | RCP | N |
20+
21+
*Y – Additional considerations apply. N – No additional considerations apply.
22+
23+
24+
**Additional consideration 1:**
25+
26+
Perimeter type applicability: identity and resource perimeter applied on network.
27+
28+
The service does not currently support VPC endpoint policies.
29+
30+
If you want to restrict access to your networks to trusted identities and trusted resources, consider implementing these additional controls:
31+
32+
* **Preventative control example 1**: Consider implementing `aws:ResourceOrgID` in an SCP to restrict service API calls so that your identities can only access trusted resources. See [resource_perimeter_scp.json](https://github.com/aws-samples/data-perimeter-policy-examples/blob/main/service_control_policies/resource_perimeter_scp.json) for an example policy.
33+
* **Preventative control example 2**: Consider using your existing security appliances such as outbound proxies to inspect service API calls in your environment for the identities making the calls and resources being accessed, and restrict the calls accordingly. This type of solution might have implications for security, scalability, latency, and reliability that you should evaluate carefully.
34+
35+
36+
**List of service APIs reviewed against data perimeter control objectives**
37+
38+
* DeleteKey
39+
* DescribeKeyValueStore
40+
* GetKey
41+
* ListKeys
42+
* PutKey
43+
* UpdateKeys
44+
45+

0 commit comments

Comments
 (0)