data-perimeter-policy-examples/resource_control_policies/identity_perimeter_rcp.json at main · aws-samples/data-perimeter-policy-examples · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EnforceOrgIdentities",
            "Effect": "Deny",
            "Principal": "*",
            "Action": [
                "s3:*",
                "sts:AssumeRole",
                "sts:DecodeAuthorizationMessage",
                "sts:GetAccessKeyInfo",
                "sts:GetFederationToken",
                "sts:GetServiceBearerToken",
                "sts:GetSessionToken",
                "sts:SetContext",
                "kms:*",
                "sqs:*",
                "secretsmanager:*",
                "cognito-idp:*",
                "logs:*",
                "dynamodb:*",
                "ecr:*",
                "aoss:*"
            ],
            "Resource": "*",
            "Condition": {
                "StringNotEqualsIfExists": {
                    "aws:PrincipalOrgID": "<my-org-id>",
                    "aws:PrincipalAccount": [
                        "<load-balancing-account-id>",
                        "<fin-space-account-id>",
                        "<third-party-account-a>",
                        "<third-party-account-b>"
                    ],
                    "aws:ResourceTag/dp:exclude:identity": "true"
                },
                "BoolIfExists": {
                    "aws:PrincipalIsAWSService": "false"
                }
            }
        },
        {
          "Sid": "EnforceTrustedOIDCTenants",
          "Effect": "Deny",
          "Principal": "*",
          "Action": "sts:AssumeRoleWithWebIdentity",
          "Resource": "*",
          "Condition": {
                "StringNotEqualsIfExists": {
                    "<OIDC_provider_name_1>:sub": "<my-tenant-value>",
                    "aws:ResourceTag/dp:exclude:identity": "true"
                },
                "Null": {
                    "<OIDC_provider_name_1>:sub": "false"
                }
          }
        },
        {
            "Sid": "EnforceTrustedOIDCProviders",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Resource": "*",
            "Condition": {
                "Null": {
                    "<OIDC_provider_name_1>:sub": "true",
                    "<OIDC_provider_name_2>:sub": "true"
                }
            }
        },
        {
            "Sid": "EnforceConfusedDeputyProtection",
            "Effect": "Deny",
            "Principal": "*",
            "Action": [
                "s3:*",
                "sts:*",
                "kms:*",
                "sqs:*",
                "secretsmanager:*",
                "cognito-identity:*",
                "cognito-idp:*",
                "logs:*",
                "dynamodb:*",
                "ecr:*",
                "aoss:*"
            ],
            "Resource": "*",
            "Condition": {
                "StringNotEqualsIfExists": {
                    "aws:SourceOrgID": "<my-org-id>",
                    "aws:SourceAccount": [
                        "<third-party-account-a>",
                        "<third-party-account-b>"
                    ],
                    "aws:ResourceTag/dp:exclude:identity": "true"
                },
                "Null": {
                    "aws:SourceAccount": "false"
                },
                "Bool": {
                    "aws:PrincipalIsAWSService": "true"
                }
            }
        }
    ]
}