AWS SCP Example Org Policy

SCP-OrgPolicy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "RequireMicroInstanceType",
            "Effect": "Deny",
            "Action": "ec2:RunInstances",
            "Resource": "arn:aws:ec2:*:*:instance/*",
            "Condition": {
                "StringNotEquals": {
                    "ec2:InstanceType": "t2.micro"
                }
            }
        },
        {
            "Sid": "DenyACM",
            "Effect": "Deny",
            "Action": [
                "acm-pca:CreateCertificateAuthority",
                "acm-pca:DeleteCertificateAuthority",
                "acm-pca:CreatePermission",
                "acm-pca:DeletePermission",
                "acm-pca:DescribeCertificateAuthorityAuditReport",
                "acm-pca:RestoreCertificateAuthority",
                "acm-pca:TagCertificateAuthority",
                "acm-pca:UntagCertificateAuthority"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "DenyAccessToRI",
            "Effect": "Deny",
            "Action": [
                "ec2:PurchaseReservedInstancesOffering",
                "ec2:AcceptReservedInstancesExchangeQuote",
                "ec2:CancelCapacityReservation",
                "ec2:CancelReservedInstancesListing",
                "ec2:CreateCapacityReservation",
                "ec2:CreateReservedInstancesListing"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "DenyAccessToCreateSavingsPlans",
            "Effect": "Deny",
            "Action": [
                "savingsplans:CreateSavingsPlans"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "DenyRemovalOfGuardDuty",
            "Effect": "Deny",
            "Action": [
                "guardduty:DeleteDetector",
                "guardduty:CreateSampleFindings",
                "guardduty:DisassociateFromMasterAccount"
            ],
            "Resource": "*"
        },
        {
            "Sid": "PreventLeavingOrg",
            "Effect": "Deny",
            "Action": "organizations:LeaveOrganization",
            "Resource": "*"
        },
        {
            "Sid": "RestrictToOneRegion",
            "Effect": "Deny",
            "NotAction": [
                "a4b:*",
                "artifact:*",
                "aws-portal:*",
                "budgets:*",
                "ce:*",
                "chime:*",
                "cloudfront:*",
                "cur:*",
                "datapipeline:GetAccountLimits",
                "directconnect:",
                "globalaccelerator:*",
                "health:*",
                "iam:*",
                "importexport:*",
                "mobileanalytics:*",
                "organizations:*",
                "resource-groups:*",
                "route53:*",
                "route53domains:*",
                "s3:GetBucketLocation",
                "s3:ListAllMyBuckets",
                "shield:*",
                "support:*",
                "tag:*",
                "trustedadvisor:*",
                "waf:*",
                "wellarchitected:*"
            ],
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "ap-southeast-2"
                    ]
                }
            }
        }
    ]
}