tl;dr

Todo

Table of Contents

Todo

Why This is Hard (need a better name)

Service Control Policies (SCPs) and Resource Control Policies (RCPs)

First it’s important to understand what Service Control Policies and Resource Control Policies are in AWS. SCPs govern the behavior of the principals in your AWS Organization, it doesn’t matter what resource that principal is accessing, anything and everything the principals in your organization do, can be controlled by a service control policy

RCPs govern access to the resources in your organization. It doesn’t matter if the principal accessing the resource is inside your organization, outside your organization, an AWS Service Principal, or anonymous.

This diagram shows how different requests are governed by each policy type.

[[SCP/RCP Request Diagram]]

These policies take effect immediately and apply to control plane and data plane operations. This makes it an extremely powerful tool to product your infrastructure and blow up your production apps. Even experienced Security and DevOps teams are cautious when deploying them.

Policy Conditions

• Sometimes present or not
• confusing condition operators

Access and permissions are complicated. When you write an SCP you must consider:

• Humans, applications, and agents inside your organization
• Access to resources inside and outside your organization
• Approved networks
• Exceptions to all of these

When you write an RCP you muse consider:

• Humans, applications, and agents inside your organization
• Third party partners with approved access to your resources and data
• AWS Services
• Approved networks
• Exceptions to all of these

Since organization policies apply to every request by your principals or to your resources, you have to consider every possible scenario and exception. IAM provides conditions to allow you to scope down the effective of your policies. It’s a declarative programming language like CSS in 2005 without the elegance of being able to put border: 12px solid red to make sure you haven’t gone completely off the rails.

For example in an SCP you can exclude a principal from a rule using a test on the aws:PrincipalArn context key:

{
  "Effect": "Deny",
  "Action": [
    "service:BadAction"
  ],
  "Resource": "*",
  "Condition": {
    "ArnNotLike": {
      "aws:PrincipalARN": "arn:aws:iam::111111111111:role/privileged-role"
    }
  }
}

or you can use ABAC if you are a silly goose:

{
  "Effect": "Deny",
  "Action": [
    "service:BadAction"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "aws:PrincipalTag/dp:include:network": "true"
    }
  }
}

You can use these conditions to express compound conditions such as “only allowed from my VPCs and IP addresses with exceptions” ¹:

{
  "Effect": "Deny",
  "Action": [
    "service:BadAction"
  ],
  "Resource": "*",
  "Condition": {
    "NotIpAddressIfExists": {
      "aws:SourceIp": [
        "203.0.113.0/24"
      ]
    },
    "StringNotEqualsIfExists": {
      "aws:PrincipalTag/dp:exclude:network": "true",
      "aws:VpceOrgID": "o-exampleorg1234"
    }
  }
}

When you are writing RCPs things get a little more complicated because the Principal can be in your org or outside, or an AWS service principal.

So you need to consider all three when creating them and the conditions add up.

{
  "Effect": "Deny",
  "Action": [
    "service:BadAction"
  ],
  "Resource": "*",
  "Condition": {
    "NotIpAddressIfExists": {
      // Can be from my data center/VPN known IPs
      "aws:SourceIp": "<my-corporate-cidr>"
    },
    "StringNotEqualsIfExists": {
      // Can be within a vpc endpoint in my org
      "aws:VpceOrgID": "o-myOrgId",
      // Principal can be excluded
      "aws:PrincipalTag/dp:exclude:network": "true",
      // Principal can be in excluded accounts
      "aws:PrincipalAccount": [
        "<load-balancing-account-id>",
        "<fin-space-account-id>"
      ],
      // Can be from a vpc endpoint in a known account you trust
      "aws:VpceAccount": [
        "11111111111",
        "11111111111"
      ],
      // The resource can have an exception
      "aws:ResourceTag/dp:exclude:network": "true"
    },
    "BoolIfExists": {
      // The principal can be an AWS service
      "aws:PrincipalIsAWSService": "false",
      // The principal can be acting via an AWS Service which has it's own network
      "aws:ViaAWSService": "false"
    }
  }
}

Serious Complexity

Talk about De Morgans Law, how Deny exceptions interact and overlap.

iam-truth

CLI

• Installation
• Scan an SCP/RCP
• View Results
• Summarize
• Formats

Web tool

• Paste in a policy, use the editor, or pick an example policy
• View the results Table
• View an Explain
• Add multiple resources or actions

Footnotes

1. This is extract from a larger AWS example network perimeter scp. ↩