AWS SCPs Policies

DenyDisableAudit.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "organizations:LeaveOrganization",
                "config:DeleteConfigRule",
                "config:DeleteConfigurationRecorder",
                "config:DeleteDeliveryChannel",
                "config:StopConfigurationRecorder",
                "config:PutConfigurationRecorder",
                "config:PutDeliveryChannel",
                "config:PutRetentionConfiguration",
                "cloudtrail:StopLogging",
                "cloudtrail:PutEventSelectors",
                "cloudtrail:UpdateTrail",
                "cloudtrail:DeleteTrail",
                "guardduty:DeclineInvitations",
                "guardduty:DeleteDetector",
                "guardduty:DeleteFilter",
                "guardduty:DeleteInvitations",
                "guardduty:UpdateDetector",
                "guardduty:DisassociateFromMasterAccount",
                "guardduty:DisassociateMembers",
                "securityhub:DeclineInvitations",
                "securityhub:DeleteActionTarget",
                "securityhub:DeleteInvitations",
                "securityhub:DeleteMembers",
                "securityhub:DisassociateFromMasterAccount",
                "securityhub:DisassociateMembers",
                "securityhub:UpdateActionTarget"
            ],
            "Resource": "*"
        }
    ]
}

DenyExceptTokyo.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "ec2:*",
                "ecs:*",
                "ecr:*",
                "rds:*",
                "elasticbeanstalk:*",
                "elasticache:*",
                "lambda:*",
                "dynamodb:*",
                "athena:*",
                "logs:*",
                "redshift:*",
                "codebuild:*",
                "codecommit:*",
                "codedeploy:*",
                "codepipeline:*"
            ],
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "ap-northeast-1"
                    ]
                }
            }
        }
    ]
}

PreventDangerousOperations.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "rds:DeleteDBCluster",
                "rds:DeleteDBClusterSnapshot",
                "rds:DeleteDBInstanceAutomatedBackup",
                "rds:DeleteGlobalCluster",
                "elasticache:DeleteCacheCluster",
                "elasticache:DeleteSnapshot",
                "dynamodb:DeleteBackup",
                "dynamodb:DeleteTable",
                "cognito-idp:DeleteUserPool",
                "s3:DeleteBucket"
            ],
            "Resource": "*",
            "Condition": {
                "StringNotLike": {
                    "aws:PrincipalARN": [
                        "arn:aws:iam::*:root",
                        "arn:aws:iam::*:role/super-admin"
                    ]
                }
            }
        }
    ]
}