mirror of
https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git
synced 2026-09-30 05:43:17 +00:00
10e66c92c0
cdk import by Id (non-mutating), content byte-exact from describe-policy, targetIds = exact live attachments. Post-import drift detection: IN_SYNC, 0 drifted. All four Retain — the full org guardrail set is now drift-checked IaC.
50 lines
2.5 KiB
JSON
50 lines
2.5 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "RequireBoundaryOnRoleAndUserCreate",
|
|
"Effect": "Deny",
|
|
"Action": ["iam:CreateRole", "iam:CreateUser"],
|
|
"Resource": "*",
|
|
"Condition": {
|
|
"StringNotEquals": { "iam:PermissionsBoundary": "arn:aws:iam::396287094661:policy/external-dev-execution-boundary" },
|
|
"ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*", "arn:aws:iam::396287094661:role/githubdeploy-seahaven-external-dev-baseline"] }
|
|
}
|
|
},
|
|
{
|
|
"Sid": "ProtectBoundaryPolicyFromEdits",
|
|
"Effect": "Deny",
|
|
"Action": ["iam:CreatePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeletePolicy", "iam:DeletePolicyVersion"],
|
|
"Resource": "arn:aws:iam::396287094661:policy/external-dev-execution-boundary"
|
|
},
|
|
{
|
|
"Sid": "DenyAlteringPermissionsBoundaries",
|
|
"Effect": "Deny",
|
|
"Action": ["iam:DeleteRolePermissionsBoundary", "iam:DeleteUserPermissionsBoundary", "iam:PutRolePermissionsBoundary", "iam:PutUserPermissionsBoundary"],
|
|
"Resource": "*",
|
|
"Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*"] } }
|
|
},
|
|
{
|
|
"Sid": "DenyIamUserAndAccessKeyCreation",
|
|
"Effect": "Deny",
|
|
"Action": ["iam:CreateUser", "iam:CreateAccessKey", "iam:CreateLoginProfile"],
|
|
"Resource": "*",
|
|
"Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole"] } }
|
|
},
|
|
{
|
|
"Sid": "ProtectPrivilegedRoles",
|
|
"Effect": "Deny",
|
|
"Action": ["iam:UpdateAssumeRolePolicy", "iam:AttachRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:DeleteRolePolicy", "iam:DeleteRole", "iam:UpdateRole", "iam:TagRole", "iam:UntagRole"],
|
|
"Resource": [
|
|
"arn:aws:iam::396287094661:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::396287094661:role/cdk-hnb659fds-*",
|
|
"arn:aws:iam::396287094661:role/githubdeploy-*",
|
|
"arn:aws:iam::396287094661:role/seahaven-extdev-config-recorder-role",
|
|
"arn:aws:iam::396287094661:role/seahaven-extdev-config-custom-resource-role",
|
|
"arn:aws:iam::396287094661:role/aws-service-role/*"
|
|
],
|
|
"Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*"] } }
|
|
}
|
|
]
|
|
}
|
|
|