terraform-aws-ou-scp

KO | EN

gitlite — search

#javascript #library #nodejs #css #game #animation #hacktoberfest #dotnet #java #golang #epub #cli

terraform-aws-ou-scp

★ 55 Open GitHub ↗

Combines AWS Organizations Service Control Policies (SCP)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

## AWS OU SCP Terraform Module

Supports two main use cases:

* Combines multiple Service Control Policy (SCP) statements - based on the module [`terraform-aws-org-scp`](https://github.com/trussworks/terraform-aws-org-scp) (_deprecated_). Combining multiple policy statements into a single policy allows more than 5 policies to be be applied to a single Organizational Unit (OU).
* Alternatively, creates a "Deny All Access" Service Control Policy.

Alternatively, enables creation of a "Deny All Access" Service Control Policy.

Policy options (listed by `sid`) are:

* Deny leaving AWS Organizations (DenyLeavingOrgs)
* Deny creating IAM users or access keys (DenyCreatingIAMUsers)
* Deny deleting KMS Keys (DenyDeletingKMSKeys)
* Deny deleting Route53 Hosted Zones (DenyDeletingRoute53Zones)
* Deny deleting VPC Flow logs, Cloudwatch log groups, and Cloudwatch log streams (DenyDeletingCloudwatchLogs)
* Deny root account (DenyRootAccount)
* Protect S3 Buckets (ProtectS3Buckets)
* Deny S3 Buckets Public Access (DenyS3BucketsPublicAccess)
* Protect IAM Roles (ProtectIAMRoles)
* Restrict EC2 Instance Types (LimitEC2InstanceTypes)
* Restrict Regional Operations (LimitRegions)
* Require S3 encryption (DenyIncorrectEncryptionHeader + DenyUnEncryptedObjectUploads)

### Usage for combined policy statements

To include a policy in your combined policy block, set it to `true`. Otherwise omit the policy variable.

```hcl
module "github_terraform_aws_ou_scp" {
  source = "trussworks/ou-scp/aws"
  target =  aws_organizations_organizational_unit.my_ou

# don't allow all accounts to be able to leave the org
  deny_leaving_orgs             = true
  # applies to accounts that are not managing IAM users
  deny_creating_iam_users       = true
  # don't allow deleting KMS keys
  deny_deleting_kms_keys        = true
  # don't allow deleting Route53 zones
  deny_deleting_route53_zones   = true
  # don't allow deleting CloudWatch logs
  deny_deleting_cloudwatch_logs = true
  # don't allow access to the root user
  deny_root_account             = true

protect_s3_buckets            = true
  # protect terraform statefile bucket
  protect_s3_bucket_resources   = [
    "arn:aws:s3:::prod-terraform-state-us-west-2",
    "arn:aws:s3:::prod-terraform-state-us-west-2/*"
  ]

# don't allow public access to bucket
  deny_s3_buckets_public_access = true
  deny_s3_bucket_public_access_resources = [
    "arn:aws:s3:::log-delivery-august-2020"
  ]

protect_iam_roles             = true
  # - protect OrganizationAccountAccessRole
  protect_iam_role_resources     = [
    "arn:aws:iam::*:role/OrganizationAccountAccessRole"
  ]

# restrict EC2 instance types
  limit_ec2_instance_types   = true
  allowed_ec2_instance_types = ["t2.medium"]

# restrict region-specific operations to us-west-2
  limit_regions                 = true
  # - restrict region-specific operations to us-west-2
  allowed_regions               = ["us-west-2"]

# require s3 objects be encrypted
  require_s3_encryption = true

# SCP policy tags
  tags = {
    managed_by = "terraform"
  }
}
```

### Usage for a policy which denies all access

```hcl
module "github_terraform_aws_ou_scp" {
  source = "trussworks/ou-scp/aws"
  target =  aws_organizations_organizational_unit.my_ou

# don't allow any access at all
  deny_all=true
}
```

## Requirements

| Name | Version |
|------|---------|
| terraform | >= 1.0 |
| aws | >= 3.0 |

## Providers

| Name | Version |
|------|---------|
| aws | >= 3.0 |

## Resources

| Name | Type |
|------|------|
| [aws_organizations_policy.generated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |
| [aws_organizations_policy_attachment.generated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy_attachment) | resource |
| [aws_iam_policy_document.combined_policy_block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_iam_policy_document.deny_all_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| allowed_ec2_instance_types | EC2 instances types allowed for use | `list(string)` | ```[ "" ]``` | no |
| allowed_regions | AWS Regions allowed for use (for use with the restrict regions SCP) | `list(string)` | ```[ "" ]``` | no |
| deny_all | If false, create a combined policy. If true, deny all access | `bool` | `false` | no |
| deny_creating_iam_users | DenyCreatingIAMUsers in the OU policy. | `bool` | `false` | no |
| deny_deleting_cloudwatch_logs | DenyDeletingCloudwatchLogs in the OU policy. | `bool` | `false` | no |
| deny_deleting_kms_keys | DenyDeletingKMSKeys in the OU policy. | `bool` | `false` | no |
| deny_deleting_route53_zones | DenyDeletingRoute53Zones in the OU policy. | `bool` | `false` | no |
| deny_leaving_orgs | DenyLeavingOrgs in the OU policy. | `bool` | `false` | no |
| deny_root_account | DenyRootAccount in the OU policy. | `bool` | `false` | no |
| deny_s3_bucket_public_access_resources | S3 bucket resource ARNs to block public access | `list(string)` | ```[ "" ]``` | no |
| deny_s3_buckets_public_access | DenyS3BucketsPublicAccess in the OU policy. | `bool` | `false` | no |
| limit_ec2_instance_types | LimitEC2InstanceTypes in the OU policy. | `bool` | `false` | no |
| limit_regions | LimitRegions in the OU policy. | `bool` | `false` | no |
| protect_iam_role_resources | IAM role resource ARNs to protect from modification and deletion | `list(string)` | ```[ "" ]``` | no |
| protect_iam_roles | ProtectIAMRoles in the OU policy. | `bool` | `false` | no |
| protect_s3_bucket_resources | S3 bucket resource ARNs to protect from bucket and object deletion | `list(string)` | ```[ "" ]``` | no |
| protect_s3_buckets | ProtectS3Buckets in the OU policy. | `bool` | `false` | no |
| require_s3_encryption | DenyIncorrectEncryptionHeader and DenyUnEncryptedObjectUploads in the OU policy | `bool` | `false` | no |
| tags | Tags applied to the SCP policy | `map(string)` | `{}` | no |
| target | OU resource to attach SCP | ```object({ name = string id = string })``` | n/a | yes |

## Developer Setup

Install dependencies (macOS)

```shell
brew install pre-commit go terraform terraform-docs
pre-commit install --install-hooks
```

terraform-aws-ou-scp

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README