Skip to content

Commit b66ff1e

Browse files
nitinkul1nitinkul1
committed
Expanding service specific guidance to include 10 additional services
1 parent d2b1b14 commit b66ff1e

15 files changed

Lines changed: 1500 additions & 55 deletions

‎service_control_policies/service_specific_controls/README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,15 @@ This statement is included in the [restrict_untrusted_endpoints_scp](restrict_un
126126

127127
This statement is included in the [restrict_untrusted_endpoints_scp](restrict_untrusted_endpoints_scp.json) and prevents Step Functions from invoking HTTPS APIs that don't belong to your organization. See [IAM permissions to run an HTTP Task](https://docs.aws.amazon.com/step-functions/latest/dg/call-https-apis.html#connect-http-task-permissions) for more details.
128128

129+
### "Sid": "PreventUntrustedSESv1Emails"
130+
This statement is included in the [restrict_untrusted_endpoints_scp](restrict_untrusted_endpoints_scp.json) to restrict Simple Email Service from sending emails to addresses external to your organization. See [Conditions specific to sending authorization](https://docs.aws.amazon.com/ses/latest/dg/sending-authorization-policy-examples.html#sending-authorization-policy-conditions) for more details.
131+
132+
### "Sid": "PreventUntrustedSESv2Emails"
133+
This statement is included in the [restrict_untrusted_endpoints_scp](restrict_untrusted_endpoints_scp.json) to restrict Simple Email Service API V2 (sesv2) from sending emails to addresses external to your organization. See [Conditions specific to sending authorization](https://docs.aws.amazon.com/ses/latest/dg/sending-authorization-policy-examples.html#sending-authorization-policy-conditions) for more details.
134+
135+
### "Sid": "PreventUntrustedSESVerificationEmails"
136+
This statement is included in the [restrict_untrusted_endpoints_scp](restrict_untrusted_endpoints_scp.json) to restrict access to ses:SendCustomVerificationEmail using aws:PrincipalTag condition key as ses:Recipients condition doesnt apply to ses:SendCustomVerificationEmail
137+
129138
### "Sid": "PreventCreationOfServicePresignedURL"
130139

131140
This statement is included in the [restrict_presignedURL_scp](restrict_presignedURL_scp.json) and prevents users from making API requests that return Amazon S3 presigned URLs that are presigned by a service principal.

‎service_control_policies/service_specific_controls/restrict_presignedURL_scp.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,12 @@
77
"Action": [
88
"ecr:GetDownloadUrlForLayer",
99
"lambda:GetFunction",
10-
"ssm:GetDeployablePatchSnapshotForInstance"
10+
"ssm:GetDeployablePatchSnapshotForInstance",
11+
"lex:CreateUploadUrl",
12+
"lex:DescribeExport",
13+
"serverlessrepo:CreateCloudFormationTemplate",
14+
"serverlessrepo:GetApplication",
15+
"serverlessrepo:GetCloudFormationTemplate"
1116
],
1217
"Resource": "*",
1318
"Condition": {

‎service_control_policies/service_specific_controls/restrict_resource_policy_configurations_scp.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,11 @@
1515
"lambda:AddPermission",
1616
"logs:PutResourcePolicy",
1717
"logs:PutDestinationPolicy",
18-
"sns:AddPermission"
18+
"sns:AddPermission",
19+
"lex:CreateResourcePolicy",
20+
"lex:UpdateResourcePolicy",
21+
"schemas:PutResourcePolicy",
22+
"serverlessrepo:PutApplicationPolicy"
1923
],
2024
"Resource": "*",
2125
"Condition": {

‎service_control_policies/service_specific_controls/restrict_untrusted_endpoints_scp.json‎

Lines changed: 111 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,114 @@
11
{
2-
"Version": "2012-10-17",
3-
"Statement": [
4-
{
5-
"Sid": "PreventUntrustedSNSEmailSubscriptions",
6-
"Effect": "Deny",
7-
"Action": [
8-
"sns:Subscribe"
9-
],
10-
"Resource": "*",
11-
"Condition": {
12-
"StringEquals": {
13-
"sns:Protocol": "email"
14-
},
15-
"StringNotLike": {
16-
"sns:Endpoint": "*@<trusted_email_domain>"
17-
},
18-
"StringNotEqualsIfExists": {
19-
"aws:PrincipalTag/dp:exclude:resource": "true"
20-
}
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "PreventUntrustedSNSEmailSubscriptions",
6+
"Effect": "Deny",
7+
"Action": [
8+
"sns:Subscribe"
9+
],
10+
"Resource": "*",
11+
"Condition": {
12+
"StringEquals": {
13+
"sns:Protocol": "email"
14+
},
15+
"StringNotLike": {
16+
"sns:Endpoint": "*@<trusted_email_domain>"
17+
},
18+
"StringNotEqualsIfExists": {
19+
"aws:PrincipalTag/dp:exclude:resource": "true"
20+
}
21+
}
22+
},
23+
{
24+
"Sid": "PreventEventBridgeAPIDestinations",
25+
"Effect": "Deny",
26+
"Action": [
27+
"events:PutTargets"
28+
],
29+
"Resource": "*",
30+
"Condition": {
31+
"ForAnyValue:ArnLike": {
32+
"events:TargetArn": "arn:aws:events:*:*:api-destination/*"
33+
},
34+
"StringNotEqualsIfExists": {
35+
"aws:PrincipalTag/dp:exclude:resource": "true"
36+
}
37+
}
38+
},
39+
{
40+
"Sid": "PreventUntrustedStepFunctionsHTTPSAPI",
41+
"Effect": "Deny",
42+
"Action": [
43+
"states:InvokeHTTPEndpoint"
44+
],
45+
"Resource": "*",
46+
"Condition": {
47+
"StringNotLike": {
48+
"states:HTTPEndpoint": "<trusted_https_endpoint>"
49+
},
50+
"StringNotEqualsIfExists": {
51+
"aws:PrincipalTag/dp:exclude:resource": "true"
52+
}
53+
}
54+
},
55+
{
56+
"Sid": "PreventUntrustedSESv1Emails",
57+
"Effect": "Deny",
58+
"Action": [
59+
"ses:SendBulkTemplatedEmail",
60+
"ses:SendEmail",
61+
"ses:SendRawEmail",
62+
"ses:SendTemplatedEmail"
63+
],
64+
"Resource": "*",
65+
"Condition": {
66+
"ForAnyValue:StringNotLike": {
67+
"ses:Recipients": [
68+
"*@<trusted_email_domain>"
69+
]
70+
},
71+
"StringEquals": {
72+
"ses:ApiVersion": "1"
73+
},
74+
"StringNotEqualsIfExists": {
75+
"aws:PrincipalTag/dp:exclude:resource": "true"
76+
}
77+
}
78+
},
79+
{
80+
"Sid": "PreventUntrustedSESv2Emails",
81+
"Effect": "Deny",
82+
"Action": [
83+
"ses:SendEmail"
84+
],
85+
"Resource": "*",
86+
"Condition": {
87+
"ForAnyValue:StringNotLike": {
88+
"ses:Recipients": [
89+
"*@<trusted_email_domain>"
90+
]
91+
},
92+
"StringEquals": {
93+
"ses:ApiVersion": "2"
94+
},
95+
"StringNotEqualsIfExists": {
96+
"aws:PrincipalTag/dp:exclude:resource": "true"
97+
}
98+
}
99+
},
100+
{
101+
"Sid": "PreventUntrustedSESVerificationEmails",
102+
"Effect": "Deny",
103+
"Action": [
104+
"ses:SendCustomVerificationEmail"
105+
],
106+
"Resource": "*",
107+
"Condition": {
108+
"StringNotEqualsIfExists": {
109+
"aws:PrincipalTag/dp:exclude:resource": "true"
110+
}
111+
}
21112
}
22-
},
23-
{
24-
"Sid": "PreventEventBridgeAPIDestinations",
25-
"Effect": "Deny",
26-
"Action": [
27-
"events:PutTargets"
28-
],
29-
"Resource": "*",
30-
"Condition": {
31-
"ForAnyValue:ArnLike": {
32-
"events:TargetArn": "arn:aws:events:*:*:api-destination/*"
33-
},
34-
"StringNotEqualsIfExists": {
35-
"aws:PrincipalTag/dp:exclude:resource": "true"
36-
}
37-
}
38-
},
39-
{
40-
"Sid": "PreventUntrustedStepFunctionsHTTPSAPI",
41-
"Effect": "Deny",
42-
"Action": [
43-
"states:InvokeHTTPEndpoint"
44-
],
45-
"Resource": "*",
46-
"Condition": {
47-
"StringNotLike": {
48-
"states:HTTPEndpoint": "<trusted_https_endpoint>"
49-
},
50-
"StringNotEqualsIfExists": {
51-
"aws:PrincipalTag/dp:exclude:resource": "true"
52-
}
53-
}
54-
}
55-
]
113+
]
56114
}

0 commit comments

Comments
 (0)