SCP创建一个没有标签或有特定标签的安全组

Question

I want to create an SCP (service control policy) that should allow creating a security group if no tags are present. If a tag is created, it should have a specific value. For example, if 'bu' is a tag, the value should always be 'finance' only. How this can be done. I have done this bit:

{
  "Sid": "SGBu",
  "Effect": "Deny",
  "Action": [
    "ec2:CreateSecurityGroup"
  ],
  "Resource": [
    "arn:aws:ec2:*:*:security-group/*"
  ],
  "Condition": {
    "ForAnyValue:Null": {
      "aws:RequestTag/bu": "false"
    }
  }
}

How can I add an OR condition along with this so that the value has to be 'finance' if 'bu' tag is added?

Thank you

Answer 1

You can have multiple Conditions in a SCP but these Conditions will only work as AND. But Each Condition it self can have more than one key/value pair and the relationship between these key/value pairs is OR.

Here is an example: (See the last Condition IpAdressess)

"Condition" :  {
      "DateGreaterThan" : {
         "aws:CurrentTime" : "2019-07-16T12:00:00Z"
       },
      "DateLessThan": {
         "aws:CurrentTime" : "2019-07-16T15:00:00Z"
       },
       "IpAddress" : {
          "aws:SourceIp" : ["192.0.2.0/24", "203.0.113.0/24"]
      }
}

Here is AWS docs on it: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html

Answer 2

The best approach is to combine SCP with Tag Policies .

In this way, SCP are used to enforce tagging at resource creation and Tag Policy is used to standarize values of determined tags.

With Tag Policies you can define a list of values allowed for certain tags, enforce it for the services you select and also is case-sensitive (SCP is not case-sensitive on condition keys).

For your scenario the Tag policy could be:

• Tag key: bu
• Values: finance
• Resource types to enforce: ec2:securitygroup