spasam
/ aws-credential-actions.json
Created
April 19, 2023 15:56
AWS actions that generate or return credentials
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [ | |
| "airflow:CreateCliToken", | |
| "airflow:CreateWebLoginToken", | |
| "amplifybackend:CreateToken", | |
| "amplifybackend:GetToken", | |
| "amplifyuibuilder:ExchangeCodeForToken", | |
| "amplifyuibuilder:RefreshToken", | |
| "appsync:CreateApiKey", | |
| "appsync:ListApiKeys", | |
| "appsync:UpdateApiKey", |
spasam
/ aws-scp-network.json
Created
March 27, 2023 19:01
Restrict access to resources based on network CIDRs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Sid": "RestrictAccessBasedOnNetwork", | |
| "Effect": "Deny", | |
| "Action": [ | |
| "*" | |
| ], | |
| "Resource": [ |
spasam
/ aws-scp-ec2-sprawl.json
Created
March 27, 2023 18:51
Prevent temporary credentials issued to EC2 instances from being used elsewhere
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Effect": "Deny", | |
| "Action": "*", | |
| "Resource": "*", | |
| "Condition": { | |
| "StringNotEquals": { | |
| "aws:ec2InstanceSourceVPC": "${aws:SourceVpc}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Effect": "Deny", | |
| "Action": "*", | |
| "Resource": "*", | |
| "Condition": { | |
| "NumericLessThan": { | |
| "ec2:RoleDelivery": "2.0" |
spasam
/ aws-scp-ram-share.json
Created
March 27, 2023 18:44
Restricts sharing of resources outside of the organization using AWS Resource Access Manager (RAM)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Sid": "DenyS3ACLPermissions", | |
| "Effect": "Deny", | |
| "Action": [ | |
| "s3:PutObjectAcl", | |
| "s3:GetObjectAcl", | |
| "s3:PutBucketAcl", |
spasam
/ aws-scp-restrict-orgs.json
Created
March 27, 2023 18:39
Allow access to all resources within an AWS account for principals from multiple organizations
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Sid": "AllowAccessToMultipleOrgs", | |
| "Effect": "Allow", | |
| "Action": "*", | |
| "Resource": "*", | |
| "Condition": { | |
| "StringLike": { |
spasam
/ aws-scp-restrict-org.json
Created
March 27, 2023 18:38
Restrict access to all resources within an AWS account to only principals from the organization
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Sid": "RestrictAccessToOrg", | |
| "Effect": "Deny", | |
| "Action": "*", | |
| "Resource": "*", | |
| "Condition": { | |
| "StringNotEquals": { |
spasam
/ aws-scp-vpc-vpn.json
Created
March 25, 2023 23:21
Disallows Virtual Private Network (VPN) connections (Site-to-Site VPN and Client VPN) to an Amazon Virtual Private Cloud (VPC)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Sid": "GRDISALLOWVPNCONNECTIONS", | |
| "Effect": "Deny", | |
| "Action": [ | |
| "ec2:CreateVPNGateway", | |
| "ec2:AttachVPNGateway", | |
| "ec2:CreateCustomerGateway", |
spasam
/ aws-scp-vpc-internet.json
Last active
March 27, 2023 03:59
Disallow internet access for an Amazon Virtual Private Cloud (VPC) instance managed by a customer, rather than by an AWS service
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Sid": "GRDISALLOWVPCINTERNETACCESS", | |
| "Effect": "Deny", | |
| "Action": [ | |
| "ec2:CreateInternetGateway", | |
| "ec2:AttachInternetGateway", | |
| "ec2:CreateEgressOnlyInternetGateway", |
NewerOlder