AWS SCP 策略 - 组合语句

Question

在根/OU 上分配 SCP 策略有一个限制，为了节省资源，我试图将 2-3 个策略语句组合到一个 SCP 中，但这似乎不起作用。

有没有人在他们的“组织”中举例说明如何做到这一点？

例如使用 terraform（但 json 是重要的部分，而不是创建方法）：

resource "aws_organizations_policy" "Allowed_EC2_AND_ES_InstanceTypes" {
    name = "Allowed_EC2_AND_ES_InstanceTypes"
    type = "SERVICE_CONTROL_POLICY" 
    description = "Policy that defines which EC2 and ES Instance Types are allowed (applied via terraform)"
    tags = {"purpose": "limit EC2-ES family types"}
    content = <<CONTENT
{
    "Version": "2012-10-17",
    "Statement1": [
        {
            "Sid": "Statement1",
            "Effect": "Deny",
            "Action": ["ec2:RunInstances"],
            "Resource": ["arn:aws:ec2:*:*:instance/*"],
            "Condition": {
                "StringNotLike": {
                    "ec2:InstanceType": [
                    "t3.*",
                    "m5.*",
                    "r5.*",
                    "c5.*",
                    "m6i.*"
                  ]
                }
            }
          }
        ],
    "Statement2": [
        {
            "Sid": "Statement2",
            "Effect": "Deny",
            "Action": [
                "es:CreateDomain",
                "es:CreateElasticsearchDomain"
                ],
            "Resource": [
                "*"
                ],
            "Condition": {
                "ForAnyValue:StringEquals": {
                "aws:PrincipalType": [
                    "t2.*",
                    "c4.*",
                    "m3.*",
                    "m4.*",
                    "r3.*",
                    "r4.*"
              ]
           }
        }
      }
   ] 
}
CONTENT
}

非常感谢！

Answer 1

我认为应该有一个 "Statement" : []。在这个[ ]里面，写入了多个从"Sid": 开始的项目。

在aws-doc:

Statement 元素是策略的主要元素。这个元素 是必须的。 Statement 元素可以包含单个语句或 一组单独的语句。每个单独的语句块 必须用花括号 { } 括起来。对于多个语句， 数组必须用方括号 [ ] 括起来。 "Statement": [{...},{...},{...}]

因此你的例子应该是这样的。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Deny",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*"
            ],
            "Condition": {
                "StringNotLike": {
                    "ec2:InstanceType": [
                        "t3.*",
                        "m5.*",
                        "r5.*",
                        "c5.*",
                        "m6i.*"
                    ]
                }
            }
        },
        {
            "Sid": "Statement2",
            "Effect": "Deny",
            "Action": [
                "es:CreateDomain",
                "es:CreateElasticsearchDomain"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:PrincipalType": [
                        "t2.*",
                        "c4.*",
                        "m3.*",
                        "m4.*",
                        "r3.*",
                        "r4.*"
                    ]
                }
            }
        }
    ]
}