Skip to content

Commit c6c05a6

Browse files
snemetzsnemetz
committed
Add SCP policies
1 parent 8f5633d commit c6c05a6

12 files changed

+206
-102
lines changed

‎modules/scp/README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,16 @@ No modules.
2626

2727
| Name | Type |
2828
|------|------|
29+
| [aws_organizations_policy.deny_access_analyzer_disable](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |
2930
| [aws_organizations_policy.deny_cloudtrail_disable](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |
3031
| [aws_organizations_policy.deny_cloudtrail_tamper](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |
3132
| [aws_organizations_policy.deny_config_modify](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |
33+
| [aws_organizations_policy.deny_ebs_default_encryption_disable](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |
3234
| [aws_organizations_policy.deny_ecr_create_write](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |
3335
| [aws_organizations_policy.deny_guardduty_modify](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |
3436
| [aws_organizations_policy.deny_member_leaving](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |
3537
| [aws_organizations_policy.deny_s3_public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |
38+
| [aws_organizations_policy.deny_securityhub_disable](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |
3639
| [aws_organizations_policy.require_s3_encryption](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |
3740

3841
## Inputs
@@ -41,13 +44,15 @@ No modules.
4144
|------|-------------|------|---------|:--------:|
4245
| <a name="input_account_type"></a> [account\_type](#input\_account\_type) | AWS account type (master, administrator, log, member) | `string` | n/a | yes |
4346
| <a name="input_enable"></a> [enable](#input\_enable) | Enable managing SCP policies | `bool` | `true` | no |
47+
| <a name="input_enable_access_analyzer"></a> [enable\_access\_analyzer](#input\_enable\_access\_analyzer) | Manage AWS IAM Access Analyzer SCP policies | `bool` | `true` | no |
4448
| <a name="input_enable_cloudtrail"></a> [enable\_cloudtrail](#input\_enable\_cloudtrail) | Manage AWS CloudTrail SCP policies | `bool` | `true` | no |
45-
| <a name="input_enable_config"></a> [enable\_config](#input\_enable\_config) | Manage AWS Config SCP policies | `bool` | `true` | no |
49+
| <a name="input_enable_config"></a> [enable\_config](#input\_enable\_config) | Manage AWS Config SCP policies | `bool` | `true` | no |
4650
| <a name="input_enable_ebs"></a> [enable\_ebs](#input\_enable\_ebs) | Manage EBS SCP policies | `bool` | `true` | no |
4751
| <a name="input_enable_ecr"></a> [enable\_ecr](#input\_enable\_ecr) | Manage ECR SCP policies | `bool` | `true` | no |
4852
| <a name="input_enable_guardduty"></a> [enable\_guardduty](#input\_enable\_guardduty) | Manage AWS GuardDuty SCP policies | `bool` | `true` | no |
4953
| <a name="input_enable_iam"></a> [enable\_iam](#input\_enable\_iam) | Manage IAM SCP policies | `bool` | `true` | no |
5054
| <a name="input_enable_s3"></a> [enable\_s3](#input\_enable\_s3) | Manage S3 SCP policies | `bool` | `true` | no |
55+
| <a name="input_enable_securityhub"></a> [enable\_securityhub](#input\_enable\_securityhub) | Manage AWS Security Hub SCP policies | `bool` | `true` | no |
5156
| <a name="input_tags"></a> [tags](#input\_tags) | Specifies object tags key and value. This applies to all resources created by this module. | `map(any)` | <pre>{<br> "Environment": "infra",<br> "Product": "security",<br> "Team": "devops",<br> "Terraform": true<br>}</pre> | no |
5257

5358
## Outputs

‎modules/scp/files/deny-access-analyzer-disable.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "DenyAccessAnalyzerDisable",
6+
"Effect": "Deny",
7+
"Action": [
8+
"access-analyzer:DeleteAnalyzer"
9+
],
10+
"Resource": [
11+
"*"
12+
]
13+
}
14+
]
15+
}

‎modules/scp/files/deny-cloudtrail-tamper.json‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
2-
"Sid": "PreventTamperingWithCloudTrail",
3-
"Effect": "Deny",
4-
"Action": [
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "PreventTamperingWithCloudTrail",
6+
"Effect": "Deny",
7+
"Action": [
58
"cloudtrail:DeleteTrail",
69
"cloudtrail:StopLogging",
710
"cloudtrail:PutEventSelectors",
811
"cloudtrail:UpdateTrail"
9-
],
10-
"Resource": [
12+
],
13+
"Resource": [
1114
"arn:aws:cloudtrail:*:*:trail/*"
12-
]
15+
]
16+
}
17+
]
1318
}

‎modules/scp/files/deny-ebs-default-encryption-disable.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "DenyEbsDefaultEncryptionDisable",
6+
"Effect": "Deny",
7+
"Action": [
8+
"ec2:DisableEbsEncryptionByDefault"
9+
],
10+
"Resource": [
11+
"*"
12+
]
13+
}
14+
]
15+
}

‎modules/scp/files/deny-ecr-create-write.json‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
{
2-
"Version": "2012-10-17",
3-
"Statement": [
4-
{
5-
"Sid": "DenyECRCreateWrite",
6-
"Effect": "Deny",
7-
"Action": [
8-
"ecr:BatchDeleteImage",
9-
"ecr:CompleteLayerUpload",
10-
"ecr:CreateRepository",
11-
"ecr:DeleteRepository",
12-
"ecr:DeleteRepositoryPolicy",
13-
"ecr:GetRepositoryPolicy",
14-
"ecr:InitiateLayerUpload",
15-
"ecr:PutImage",
16-
"ecr:SetRepositoryPolicy",
17-
"ecr:UploadLayerPart"
18-
],
19-
"Resource": [
20-
"*"
21-
]
22-
}
23-
]
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "DenyECRCreateWrite",
6+
"Effect": "Deny",
7+
"Action": [
8+
"ecr:BatchDeleteImage",
9+
"ecr:CompleteLayerUpload",
10+
"ecr:CreateRepository",
11+
"ecr:DeleteRepository",
12+
"ecr:DeleteRepositoryPolicy",
13+
"ecr:GetRepositoryPolicy",
14+
"ecr:InitiateLayerUpload",
15+
"ecr:PutImage",
16+
"ecr:SetRepositoryPolicy",
17+
"ecr:UploadLayerPart"
18+
],
19+
"Resource": [
20+
"*"
21+
]
22+
}
23+
]
2424
}

‎modules/scp/files/deny-guardduty-modify.json‎

Lines changed: 41 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,43 @@
11
{
2-
"Version": "2012-10-17",
3-
"Statement": [
4-
{
5-
"Sid": "DenyGuardDutyModify",
6-
"Effect": "Deny",
7-
"Action": [
8-
"guardduty:AcceptInvitation",
9-
"guardduty:ArchiveFindings",
10-
"guardduty:CreateDetector",
11-
"guardduty:CreateFilter",
12-
"guardduty:CreateIPSet",
13-
"guardduty:CreateMembers",
14-
"guardduty:CreatePublishingDestination",
15-
"guardduty:CreateSampleFindings",
16-
"guardduty:CreateThreatIntelSet",
17-
"guardduty:DeclineInvitations",
18-
"guardduty:DeleteDetector",
19-
"guardduty:DeleteFilter",
20-
"guardduty:DeleteInvitations",
21-
"guardduty:DeleteIPSet",
22-
"guardduty:DeleteMembers",
23-
"guardduty:DeletePublishingDestination",
24-
"guardduty:DeleteThreatIntelSet",
25-
"guardduty:DisassociateFromMasterAccount",
26-
"guardduty:DisassociateMembers",
27-
"guardduty:InviteMembers",
28-
"guardduty:StartMonitoringMembers",
29-
"guardduty:StopMonitoringMembers",
30-
"guardduty:TagResource",
31-
"guardduty:UnarchiveFindings",
32-
"guardduty:UntagResource",
33-
"guardduty:UpdateDetector",
34-
"guardduty:UpdateFilter",
35-
"guardduty:UpdateFindingsFeedback",
36-
"guardduty:UpdateIPSet",
37-
"guardduty:UpdatePublishingDestination",
38-
"guardduty:UpdateThreatIntelSet"
39-
],
40-
"Resource": "*"
41-
}
42-
]
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "DenyGuardDutyModify",
6+
"Effect": "Deny",
7+
"Action": [
8+
"guardduty:AcceptInvitation",
9+
"guardduty:ArchiveFindings",
10+
"guardduty:CreateDetector",
11+
"guardduty:CreateFilter",
12+
"guardduty:CreateIPSet",
13+
"guardduty:CreateMembers",
14+
"guardduty:CreatePublishingDestination",
15+
"guardduty:CreateSampleFindings",
16+
"guardduty:CreateThreatIntelSet",
17+
"guardduty:DeclineInvitations",
18+
"guardduty:DeleteDetector",
19+
"guardduty:DeleteFilter",
20+
"guardduty:DeleteInvitations",
21+
"guardduty:DeleteIPSet",
22+
"guardduty:DeleteMembers",
23+
"guardduty:DeletePublishingDestination",
24+
"guardduty:DeleteThreatIntelSet",
25+
"guardduty:DisassociateFromMasterAccount",
26+
"guardduty:DisassociateMembers",
27+
"guardduty:InviteMembers",
28+
"guardduty:StartMonitoringMembers",
29+
"guardduty:StopMonitoringMembers",
30+
"guardduty:TagResource",
31+
"guardduty:UnarchiveFindings",
32+
"guardduty:UntagResource",
33+
"guardduty:UpdateDetector",
34+
"guardduty:UpdateFilter",
35+
"guardduty:UpdateFindingsFeedback",
36+
"guardduty:UpdateIPSet",
37+
"guardduty:UpdatePublishingDestination",
38+
"guardduty:UpdateThreatIntelSet"
39+
],
40+
"Resource": "*"
41+
}
42+
]
4343
}

‎modules/scp/files/deny-member-leaving.json‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"Version": "2012-10-17",
3-
"Statement": [
4-
{
5-
"Sid": "DenyOrgMemberLeaving",
6-
"Effect": "Deny",
7-
"Action": [
8-
"organizations:LeaveOrganization"
9-
],
10-
"Resource": [
11-
"*"
12-
]
13-
}
14-
]
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "DenyOrgMemberLeaving",
6+
"Effect": "Deny",
7+
"Action": [
8+
"organizations:LeaveOrganization"
9+
],
10+
"Resource": [
11+
"*"
12+
]
13+
}
14+
]
1515
}

‎modules/scp/files/deny-s3-public.json‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"Sid": "PreventS3PublicAccess",
3-
"Action": [
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "PreventS3PublicAccess",
6+
"Effect": "Deny",
7+
"Action": [
48
"s3:PutAccountPublicAccessBlock"
5-
],
6-
"Resource": "*",
7-
"Effect": "Deny"
9+
],
10+
"Resource": "*"
11+
}
12+
]
813
}

‎modules/scp/files/deny-securityhub-disable.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "DenySecurityHubDisable",
6+
"Effect": "Deny",
7+
"Action": [
8+
"securityhub:DeleteInvitations",
9+
"securityhub:DeleteMembers",
10+
"securityhub:DisableSecurityHub",
11+
"securityhub:DisassociateFromMasterAccount",
12+
"securityhub:DisassociateMembers"
13+
],
14+
"Resource": "*"
15+
}
16+
]
17+
}

‎modules/scp/main.tf‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,18 @@
44
locals {
55
enable = var.enable && var.account_type == "master"
66
}
7+
### -----------------------
8+
### Access Analyzer
9+
### -----------------------
10+
resource "aws_organizations_policy" "deny_access_analyzer_disable" {
11+
count = local.enable && var.enable_access_analyzer ? 1 : 0
12+
name = "deny_access_analyzer_disable"
13+
description = "Prevent IAM Access Analyzer from being disabled"
14+
tags = var.tags
15+
type = "SERVICE_CONTROL_POLICY"
16+
content = file("${path.module}/files/deny-access-analyzer-disable.json")
17+
}
18+
719
### -----------------------
820
### CloudTrail
921
### -----------------------
@@ -38,7 +50,14 @@ resource "aws_organizations_policy" "deny_config_modify" {
3850
### -----------------------
3951
### EBS
4052
### -----------------------
41-
# deny change default encryption
53+
resource "aws_organizations_policy" "deny_ebs_default_encryption_disable" {
54+
count = local.enable && var.enable_config ? 1 : 0
55+
name = "deny_ebs_default_encryption_disable"
56+
description = "Prevent EC2 EBS default encyption from being disabled"
57+
tags = var.tags
58+
type = "SERVICE_CONTROL_POLICY"
59+
content = file("${path.module}/files/deny-ebs-default-encryption-disable.json")
60+
}
4261
### -----------------------
4362
### ECR
4463
### -----------------------
@@ -102,3 +121,14 @@ resource "aws_organizations_policy" "require_s3_encryption" {
102121
type = "SERVICE_CONTROL_POLICY"
103122
content = file("${path.module}/files/require-s3-encryption.json")
104123
}
124+
### -----------------------
125+
### Security Hub
126+
### -----------------------
127+
resource "aws_organizations_policy" "deny_securityhub_disable" {
128+
count = local.enable && var.enable_securityhub ? 1 : 0
129+
name = "deny_securityhub_disable"
130+
description = "Prevent Security Hub from being disabled"
131+
tags = var.tags
132+
type = "SERVICE_CONTROL_POLICY"
133+
content = file("${path.module}/files/deny-securityhub-disable.json")
134+
}

0 commit comments

Comments
 (0)