Score:0

AWS Organizations - How to globally set boundaries to allow assess only to predefined set of services?

cn flag

I would like to allow users in all accounts in my AWS Organization (under a number of different OUs) to access only a few AWS services: RDS, EC2, S3, etc. In other words, I need to prevent access to anything else. I was thinking about using SCP but denying access to so many services seems to be a bad idea (the FullAWSAccess service control policy is attached by default). I would like to ask if you have ever done something like that and if you have, how?

Score:1
cn flag

SCP is the way to go.

You can deny everything with a whitelist condition.

Please bear in mind that you need to reduce the scope of your SCP, otherwise you end up disabling AWS service roles to perform standard operations, e.g. if you use CloudFormation stacks.

Therefore, you should apply this SCP only to the roles used by your users and services.

Tip: use one role for implementing the SCP and one role to test it. Start small and progress in small steps. Otherwise you might exclude yourself from any service in the AWS console.

Tim avatar
gp flag
Tim
Definitely SCP. A few more thoughts based on my experience using SCP for a while. Test with one Sandbox OU, with specific roles. Note that the master account cannot have SCPs restricted. SCPs can be really fiddly, they're a union of the permissions of all the OUs and the account. When permissions don't work as expected I always look at SCP first, then IAM. Work from example SCPs, start small.
Jacek avatar
cn flag
Thank you. I have used "Deny" with "NotAction" and listed allowed services, added condition excluding one user. Testing in dev env now, looks good so far.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.