seahaven-org-baseline/lib/scp/external-dev-protect-security.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyDisablingSecurityServices",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:StopLogging", "cloudtrail:DeleteTrail", "cloudtrail:UpdateTrail",
        "guardduty:DeleteDetector", "guardduty:UpdateDetector", "guardduty:DisassociateFromMasterAccount",
        "config:StopConfigurationRecorder", "config:DeleteConfigurationRecorder", "config:DeleteDeliveryChannel",
        "securityhub:DisableSecurityHub", "securityhub:BatchDisableStandards",
        "accessanalyzer:DeleteAnalyzer", "inspector2:Disable"
      ],
      "Resource": "*",
      "Condition": {
        "ArnNotLike": { "aws:PrincipalArn": [
          "arn:aws:iam::396287094661:role/OrganizationAccountAccessRole",
          "arn:aws:iam::396287094661:role/cdk-hnb659fds-*",
          "arn:aws:iam::396287094661:role/seahaven-extdev-config-custom-resource-role"
        ]}
      }
    },
    { "Sid": "DenyLeavingOrganization", "Effect": "Deny", "Action": ["organizations:LeaveOrganization"], "Resource": "*" }
  ]
}