trussworks / terraform-aws-ou-scp Goto Github PK

We have identified the AWS Console shows some errors since we moved a Sandbox AWS account to a new AWS Organization where we are implementing AWS Organization SCPs.

The OU is using this configuration:

module "aws_org_scp_ou_sandbox" {
  source    = "trussworks/ou-scp/aws"
  version   = "~> 1.4.0"

  target    = aws_organizations_organizational_unit.sandbox

  deny_leaving_orgs             = true
  deny_root_account             = true
  protect_iam_roles             = true
  protect_iam_role_resources    = [
    "arn:aws:iam::*:role/OrganizationAccountAccessRole"
  ]
  limit_regions                 = true
  allowed_regions               = ["us-east-2"]
  require_s3_encryption = true

}

Looks like the Pricing API is not a regional service so far and it's only available in us-east-1 and ap-south-1. For this reason, like it happens with IAM or Organizations, should not be restricted as part of the SCPs.
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/using-pelong.html (see Service endpoint)

We are willing to send the PR upstream as soon as our time allows

Hello,

We are using this Terraform module in order to enforce AWS SSE encryption in the org and we found an unexpected behaviour we would like to share with you.

We created an AWS S3 bucket with default AWS SSE using Amazon key (AWS-SSE). We also enabled require_s3_encryption = true and as result the following policy was added:

{
      "Sid": "DenyIncorrectEncryptionHeader",
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": [
            "AES256",
            "aws:kms"
          ]
        }
      }
    },
    {
      "Sid": "DenyUnEncryptedObjectUploads",
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "*",
      "Condition": {
        "Null": {
          "s3:x-amz-server-side-encryption": [
            "true"
          ]
        }
      }

Our surprise is that a third party software that we run in AWS, as well as AWS CLI s3:PutObject operations, were failing.

The expected behaviour (our expected behaviour) was that given that the target AWS S3 bucket already has default AWS SSE enabled, the PutObject operations would succeed and would be allowed by the policy. Unfortunately, they are blocked.

We have been thinking on disabling this SCP, and instead, deny abt s3:CreateObject that does not have the correct setting of AWS SSE enabled. Unfortunately, this could be disabled afterwards, unless explicitely denied 🤷 .

What is your recommendation on the best and more resilient practices, especially when third-party software writes into S3 and we depend on the vendor to adapt the code to enable AWS SSE?

Tried to raise a pull request but got a 403.

However, the issue is very simple. When limiting regions, I noticed that the Access Analyzer stopped working.

This can be solved by adding this to the not_actions like this:

  #
  # Restrict Regional Operations
  #

  dynamic "statement" {
    for_each = local.limit_regions_statement
    content {
      sid    = "LimitRegions"
      effect = "Deny"

      # These actions do not operate in a specific region, or only run in
      # a single region, so we don't want to try restricting them by region.
      not_actions = [
        "access-analyzer:*",  # <--- this has been added
        "iam:*",
        "organizations:*",
        "route53:*",
        "budgets:*",
        "waf:*",
        "cloudfront:*",
        "globalaccelerator:*",
        "importexport:*",
        "support:*",
        "sts:*"
      ]

      resources = ["*"]

      condition {
        test     = "StringNotEquals"
        variable = "aws:RequestedRegion"
        values   = var.allowed_regions
      }
    }
  }

Dependabot couldn't find a go.mod for this project.

Dependabot requires a go.mod to evaluate your project's current Go dependencies. It had expected to find one at the path: /go.mod.

If this isn't a Go project, or if it is a library, you may wish to disable updates for it in the .dependabot/config.yml file in this repo.

View the update logs.

Is your feature request related to a problem? Please describe.
No

Describe the solution you'd like
Add support for multiple targets. Currently, the module accepts a single parameter as target. In some cases, we may have multiple organizations in AWS and we want several of them to have the same policy.

Describe alternatives you've considered
We can deprecate the target variable and create a new one called targets that allos us to send a list of OUs

targets =  [aws_organizations_organizational_unit.my_ou1, aws_organizations_organizational_unit.my_ou2]

hey guys! I really like your module! just found one limitation and wants to share it with you as I don't know how to deal with it...

If you use region restriction and AWS Control Tower, then you won't be able to enroll new account in your AWS ORganization. Control tower says applied SCP is in conflict with Control Tower.

I guess it will be because control tower wants to enable all required services across all govern regions. And govern regions != region limited by scp.

In this light, I consider region limit in your module as "almost useless or difficult to use". But I can imagine some people can find these feature useful as not everyone uses Control Tower..so maybe we should add some warning into documentation, don't you think?

I'd first like to say thank you for putting the initial work into this module. It looks like it will be really helpful! I'm running into an issue that I hope is easy to resolve..

The description of the required value for target is a little vague.. Is this module expecting the ARN, ID, a name tag of the desired OU you wish to apply these SCP's to or something else?

Since I already have a handful of OU's deployed to my organization, I want to perform a data lookup on a specific OU for testing.

data "aws_organizations_organization" "my_org" { }

data "aws_organizations_organizational_units" "my_ou" {
   parent_id = data.aws_organizations_organization.my_ord.roots[0].id
}

module "aws_govcloud_ou_scps" {
  source  = "trussworks/ou-scp/aws"
  version = "1.2.1"

  target = data.aws_organizations_organizational_units.my_ou
  .
  ..
  ...
}