Skip to content

Commit 124d331

Browse files
avanti-joshiavanti-joshi
authored
Merge pull request #23 from trussworks/modify_not_actions
update regionless APIs list
2 parents 4673a8f + c33b1f1 commit 124d331

File tree

3 files changed

+69
-29
lines changed

3 files changed

+69
-29
lines changed

‎.circleci/config.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,6 @@ jobs:
3737
- ~/go/pkg/mod
3838
references:
3939
circleci: trussworks/circleci:6986bb9022e5a83599feb66a7128a2d0fa12732a
40-
version: 2.1
4140
workflows:
4241
validate:
4342
jobs:

‎README.md‎

Lines changed: 34 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -94,43 +94,54 @@ module "github_terraform_aws_ou_scp" {
9494

9595
| Name | Version |
9696
|------|---------|
97-
| terraform | >= 0.13.0 |
98-
| aws | >= 3.0 |
97+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.0 |
98+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.0 |
9999

100100
## Providers
101101

102102
| Name | Version |
103103
|------|---------|
104-
| aws | >= 3.0 |
104+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.0 |
105105

106+
## Modules
107+
108+
No modules.
109+
110+
## Resources
111+
112+
| Name | Type |
113+
|------|------|
114+
| [aws_organizations_policy.generated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |
115+
| [aws_organizations_policy_attachment.generated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy_attachment) | resource |
116+
| [aws_iam_policy_document.combined_policy_block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
117+
| [aws_iam_policy_document.deny_all_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
106118

107119
## Inputs
108120

109121
| Name | Description | Type | Default | Required |
110122
|------|-------------|------|---------|:--------:|
111-
| allowed\_regions | AWS Regions allowed for use (for use with the restrict regions SCP) | `list(string)` | <pre>[<br> ""<br>]</pre> | no |
112-
| deny\_all | If false, create a combined policy. If true, deny all access | `bool` | `false` | no |
113-
| deny\_creating\_iam\_users | DenyCreatingIAMUsers in the OU policy. | `bool` | `false` | no |
114-
| deny\_deleting\_cloudwatch\_logs | DenyDeletingCloudwatchLogs in the OU policy. | `bool` | `false` | no |
115-
| deny\_deleting\_kms\_keys | DenyDeletingKMSKeys in the OU policy. | `bool` | `false` | no |
116-
| deny\_deleting\_route53\_zones | DenyDeletingRoute53Zones in the OU policy. | `bool` | `false` | no |
117-
| deny\_leaving\_orgs | DenyLeavingOrgs in the OU policy. | `bool` | `false` | no |
118-
| deny\_root\_account | DenyRootAccount in the OU policy. | `bool` | `false` | no |
119-
| deny\_s3\_bucket\_public\_access\_resources | S3 bucket resource ARNs to block public access | `list(string)` | <pre>[<br> ""<br>]</pre> | no |
120-
| deny\_s3\_buckets\_public\_access | DenyS3BucketsPublicAccess in the OU policy. | `bool` | `false` | no |
121-
| limit\_regions | LimitRegions in the OU policy. | `bool` | `false` | no |
122-
| protect\_iam\_role\_resources | IAM role resource ARNs to protect from modification and deletion | `list(string)` | <pre>[<br> ""<br>]</pre> | no |
123-
| protect\_iam\_roles | ProtectIAMRoles in the OU policy. | `bool` | `false` | no |
124-
| protect\_s3\_bucket\_resources | S3 bucket resource ARNs to protect from bucket and object deletion | `list(string)` | <pre>[<br> ""<br>]</pre> | no |
125-
| protect\_s3\_buckets | ProtectS3Buckets in the OU policy. | `bool` | `false` | no |
126-
| require\_s3\_encryption | DenyIncorrectEncryptionHeader and DenyUnEncryptedObjectUploads in the OU policy | `bool` | `false` | no |
127-
| target | OU resource to attach SCP | <pre>object({<br> name = string<br> id = string<br> })</pre> | n/a | yes |
128-
| tags | Tags to attach to the SCP policy resource | `map(string)` | <pre>[]</pre> | no |
123+
| <a name="input_allowed_regions"></a> [allowed\_regions](#input\_allowed\_regions) | AWS Regions allowed for use (for use with the restrict regions SCP) | `list(string)` | <pre>[<br> ""<br>]</pre> | no |
124+
| <a name="input_deny_all"></a> [deny\_all](#input\_deny\_all) | If false, create a combined policy. If true, deny all access | `bool` | `false` | no |
125+
| <a name="input_deny_creating_iam_users"></a> [deny\_creating\_iam\_users](#input\_deny\_creating\_iam\_users) | DenyCreatingIAMUsers in the OU policy. | `bool` | `false` | no |
126+
| <a name="input_deny_deleting_cloudwatch_logs"></a> [deny\_deleting\_cloudwatch\_logs](#input\_deny\_deleting\_cloudwatch\_logs) | DenyDeletingCloudwatchLogs in the OU policy. | `bool` | `false` | no |
127+
| <a name="input_deny_deleting_kms_keys"></a> [deny\_deleting\_kms\_keys](#input\_deny\_deleting\_kms\_keys) | DenyDeletingKMSKeys in the OU policy. | `bool` | `false` | no |
128+
| <a name="input_deny_deleting_route53_zones"></a> [deny\_deleting\_route53\_zones](#input\_deny\_deleting\_route53\_zones) | DenyDeletingRoute53Zones in the OU policy. | `bool` | `false` | no |
129+
| <a name="input_deny_leaving_orgs"></a> [deny\_leaving\_orgs](#input\_deny\_leaving\_orgs) | DenyLeavingOrgs in the OU policy. | `bool` | `false` | no |
130+
| <a name="input_deny_root_account"></a> [deny\_root\_account](#input\_deny\_root\_account) | DenyRootAccount in the OU policy. | `bool` | `false` | no |
131+
| <a name="input_deny_s3_bucket_public_access_resources"></a> [deny\_s3\_bucket\_public\_access\_resources](#input\_deny\_s3\_bucket\_public\_access\_resources) | S3 bucket resource ARNs to block public access | `list(string)` | <pre>[<br> ""<br>]</pre> | no |
132+
| <a name="input_deny_s3_buckets_public_access"></a> [deny\_s3\_buckets\_public\_access](#input\_deny\_s3\_buckets\_public\_access) | DenyS3BucketsPublicAccess in the OU policy. | `bool` | `false` | no |
133+
| <a name="input_limit_regions"></a> [limit\_regions](#input\_limit\_regions) | LimitRegions in the OU policy. | `bool` | `false` | no |
134+
| <a name="input_protect_iam_role_resources"></a> [protect\_iam\_role\_resources](#input\_protect\_iam\_role\_resources) | IAM role resource ARNs to protect from modification and deletion | `list(string)` | <pre>[<br> ""<br>]</pre> | no |
135+
| <a name="input_protect_iam_roles"></a> [protect\_iam\_roles](#input\_protect\_iam\_roles) | ProtectIAMRoles in the OU policy. | `bool` | `false` | no |
136+
| <a name="input_protect_s3_bucket_resources"></a> [protect\_s3\_bucket\_resources](#input\_protect\_s3\_bucket\_resources) | S3 bucket resource ARNs to protect from bucket and object deletion | `list(string)` | <pre>[<br> ""<br>]</pre> | no |
137+
| <a name="input_protect_s3_buckets"></a> [protect\_s3\_buckets](#input\_protect\_s3\_buckets) | ProtectS3Buckets in the OU policy. | `bool` | `false` | no |
138+
| <a name="input_require_s3_encryption"></a> [require\_s3\_encryption](#input\_require\_s3\_encryption) | DenyIncorrectEncryptionHeader and DenyUnEncryptedObjectUploads in the OU policy | `bool` | `false` | no |
139+
| <a name="input_tags"></a> [tags](#input\_tags) | Tags applied to the SCP policy | `map(string)` | `{}` | no |
140+
| <a name="input_target"></a> [target](#input\_target) | OU resource to attach SCP | <pre>object({<br> name = string<br> id = string<br> })</pre> | n/a | yes |
129141

130142
## Outputs
131143

132-
No output.
133-
144+
No outputs.
134145
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
135146

136147
## Developer Setup

‎main.tf‎

Lines changed: 35 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -201,18 +201,48 @@ data "aws_iam_policy_document" "combined_policy_block" {
201201

202202
# These actions do not operate in a specific region, or only run in
203203
# a single region, so we don't want to try restricting them by region.
204+
# List of actions can be found in the following example:
205+
# https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html
204206
not_actions = [
207+
"a4b:*",
205208
"access-analyzer:*",
206-
"iam:*",
207-
"organizations:*",
208-
"route53:*",
209+
"acm:*",
210+
"aws-marketplace-management:*",
211+
"aws-marketplace:*",
212+
"aws-portal:*",
209213
"budgets:*",
210-
"waf:*",
214+
"ce:*",
215+
"chime:*",
211216
"cloudfront:*",
217+
"config:*",
218+
"cur:*",
219+
"directconnect:*",
220+
"ec2:DescribeRegions",
221+
"ec2:DescribeTransitGateways",
222+
"ec2:DescribeVpnGateways",
223+
"fms:*",
212224
"globalaccelerator:*",
225+
"health:*",
226+
"iam:*",
213227
"importexport:*",
228+
"kms:*",
229+
"mobileanalytics:*",
230+
"networkmanager:*",
231+
"organizations:*",
232+
"pricing:*",
233+
"route53:*",
234+
"route53domains:*",
235+
"s3:GetAccountPublic*",
236+
"s3:ListAllMyBuckets",
237+
"s3:PutAccountPublic*",
238+
"shield:*",
239+
"sts:*",
214240
"support:*",
215-
"sts:*"
241+
"trustedadvisor:*",
242+
"waf-regional:*",
243+
"waf:*",
244+
"wafv2:*",
245+
"wellarchitected:*"
216246
]
217247

218248
resources = ["*"]

0 commit comments

Comments
 (0)