feat(volume_access): add regional policy constraints

Author: cgeers

modules/volume_access.cft.yaml

@@ -180,13 +180,19 @@ Resources:
                     Action: 
                     - "ec2:Describe*"
                     Resource: "*"
+                    Condition:
+                      StringEquals:
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "AllowKMSKeysListing"
                     Effect: "Allow"
                     Action:
                     - "kms:ListKeys"
                     - "kms:ListAliases"
                     - "kms:ListResourceTags"
                     Resource: "*"
+                    Condition:
+                      StringEquals:
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "AllowKMSEncryptDecrypt"
                     Effect: "Allow"
                     Action:
@@ -200,16 +206,24 @@ Resources:
                     Condition:
                       StringLike:
                         "kms:ViaService": "ec2.*.amazonaws.com"
+                      StringEquals:
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "CreateTaggedSnapshotFromVolume"
                     Effect: "Allow"
                     Action:
                     - "ec2:CreateSnapshot"
                     Resource: "*"
+                    Condition:
+                      StringEquals:
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "CopySnapshots"
                     Effect: "Allow"
                     Action:
                     - "ec2:CopySnapshot"
                     Resource: "*"
+                    Condition:
+                      StringEquals:
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "SnapshotTags"
                     Effect: "Allow"
                     Action:
@@ -219,6 +233,7 @@ Resources:
                       StringEquals:
                         "ec2:CreateAction": ["CreateSnapshot", "CopySnapshot"]
                         "aws:RequestTag/CreatedBy": "Sysdig"
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "ec2SnapshotShare"
                     Effect: "Allow"
                     Action:
@@ -229,6 +244,7 @@ Resources:
                         "aws:ResourceTag/CreatedBy": "Sysdig"
                       StringEquals:
                         "ec2:Add/userId": !Ref ScanningAccountID
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "ec2SnapshotDelete"
                     Effect: "Allow"
                     Action:
@@ -237,6 +253,8 @@ Resources:
                     Condition:
                       StringEqualsIgnoreCase:
                         "aws:ResourceTag/CreatedBy": "Sysdig"
+                      StringEquals:
+                        "aws:RequestedRegion": !Ref AWS::Region
           ScanningKmsKey:
             Type: 'AWS::KMS::Key'
             Properties:
@@ -351,13 +369,19 @@ Resources:
                     Action: 
                     - "ec2:Describe*"
                     Resource: "*"
+                    Condition:
+                      StringEquals:
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "AllowKMSKeysListing"
                     Effect: "Allow"
                     Action:
                     - "kms:ListKeys"
                     - "kms:ListAliases"
                     - "kms:ListResourceTags"
                     Resource: "*"
+                    Condition:
+                      StringEquals:
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "AllowKMSEncryptDecrypt"
                     Effect: "Allow"
                     Action:
@@ -371,16 +395,24 @@ Resources:
                     Condition:
                       StringLike:
                         "kms:ViaService": "ec2.*.amazonaws.com"
+                      StringEquals:
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "CreateTaggedSnapshotFromVolume"
                     Effect: "Allow"
                     Action:
                     - "ec2:CreateSnapshot"
                     Resource: "*"
+                    Condition:
+                      StringEquals:
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "CopySnapshots"
                     Effect: "Allow"
                     Action:
                     - "ec2:CopySnapshot"
                     Resource: "*"
+                    Condition:
+                      StringEquals:
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "SnapshotTags"
                     Effect: "Allow"
                     Action:
@@ -390,6 +422,7 @@ Resources:
                       StringEquals:
                         "ec2:CreateAction": ["CreateSnapshot", "CopySnapshot"]
                         "aws:RequestTag/CreatedBy": "Sysdig"
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "ec2SnapshotShare"
                     Effect: "Allow"
                     Action:
@@ -400,6 +433,7 @@ Resources:
                         "aws:ResourceTag/CreatedBy": "Sysdig"
                       StringEquals:
                         "ec2:Add/userId": !Ref ScanningAccountID
+                        "aws:RequestedRegion": !Ref AWS::Region
                   - Sid: "ec2SnapshotDelete"
                     Effect: "Allow"
                     Action:
@@ -408,6 +442,8 @@ Resources:
                     Condition:
                       StringEqualsIgnoreCase:
                         "aws:ResourceTag/CreatedBy": "Sysdig" 
+                      StringEquals:
+                        "aws:RequestedRegion": !Ref AWS::Region
           ScanningKmsKey:
             Type: 'AWS::KMS::Key'
             Properties: