seahaven-org-baseline/lib/scp/external-dev-iam-guardrails.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RequireBoundaryOnRoleAndUserCreate",
      "Effect": "Deny",
      "Action": ["iam:CreateRole", "iam:CreateUser"],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": { "iam:PermissionsBoundary": "arn:aws:iam::396287094661:policy/external-dev-execution-boundary" },
        "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*", "arn:aws:iam::396287094661:role/githubdeploy-seahaven-external-dev-baseline"] }
      }
    },
    {
      "Sid": "ProtectExecutionBoundary",
      "Effect": "Deny",
      "Action": ["iam:CreatePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeletePolicy", "iam:DeletePolicyVersion"],
      "Resource": "arn:aws:iam::396287094661:policy/external-dev-execution-boundary"
    },
    {
      "Sid": "ProtectShocBoundaries",
      "Effect": "Deny",
      "Action": ["iam:CreatePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeletePolicy", "iam:DeletePolicyVersion"],
      "Resource": [
        "arn:aws:iam::396287094661:policy/shoc-backend-*-boundary",
        "arn:aws:iam::396287094661:policy/shoc-frontend-new-*-deploy-boundary"
      ],
      "Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*"] } }
    },
    {
      "Sid": "DenyAlteringPermissionsBoundaries",
      "Effect": "Deny",
      "Action": ["iam:DeleteRolePermissionsBoundary", "iam:DeleteUserPermissionsBoundary", "iam:PutRolePermissionsBoundary", "iam:PutUserPermissionsBoundary"],
      "Resource": "*",
      "Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*"] } }
    },
    {
      "Sid": "DenyIamUserAndAccessKeyCreation",
      "Effect": "Deny",
      "Action": ["iam:CreateUser", "iam:CreateAccessKey", "iam:CreateLoginProfile"],
      "Resource": "*",
      "Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole"] } }
    },
    {
      "Sid": "ProtectNonGithubPrivilegedRoles",
      "Effect": "Deny",
      "Action": ["iam:UpdateAssumeRolePolicy", "iam:AttachRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:DeleteRolePolicy", "iam:DeleteRole", "iam:UpdateRole", "iam:TagRole", "iam:UntagRole"],
      "Resource": [
        "arn:aws:iam::396287094661:role/OrganizationAccountAccessRole",
        "arn:aws:iam::396287094661:role/cdk-hnb659fds-*",
        "arn:aws:iam::396287094661:role/seahaven-extdev-config-recorder-role",
        "arn:aws:iam::396287094661:role/seahaven-extdev-config-custom-resource-role",
        "arn:aws:iam::396287094661:role/aws-service-role/*"
      ],
      "Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*"] } }
    },
    {
      "Sid": "ProtectDeploymentPrincipalLifecycle",
      "Effect": "Deny",
      "Action": ["iam:UpdateAssumeRolePolicy", "iam:AttachRolePolicy", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:DeleteRole", "iam:UpdateRole", "iam:UpdateRoleDescription", "iam:PutRolePermissionsBoundary", "iam:DeleteRolePermissionsBoundary"],
      "Resource": ["arn:aws:iam::396287094661:role/githubdeploy-*", "arn:aws:iam::396287094661:role/hcptf-*"],
      "Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*"] } }
    },
    {
      "Sid": "ProtectGithubRoleMetadata",
      "Effect": "Deny",
      "Action": ["iam:PutRolePolicy", "iam:TagRole", "iam:UntagRole"],
      "Resource": "arn:aws:iam::396287094661:role/githubdeploy-*",
      "Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*", "arn:aws:iam::396287094661:role/hcptf-shoc-backend-tf-poc", "arn:aws:iam::396287094661:role/hcptf-shoc-backend-dev", "arn:aws:iam::396287094661:role/hcptf-shoc-backend-staging", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-dev", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-staging"] } }
    },
    {
      "Sid": "DenyUnmanagedGithubRole",
      "Effect": "Deny",
      "Action": ["iam:PutRolePolicy", "iam:TagRole", "iam:UntagRole"],
      "Resource": "arn:aws:iam::396287094661:role/githubdeploy-*",
      "Condition": {
        "ArnLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/hcptf-shoc-backend-*", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-*"] },
        "Null": { "aws:ResourceTag/HcpTerraformWorkspace": "true" }
      }
    },
    {
      "Sid": "EnforceGithubRoleManagerTag",
      "Effect": "Deny",
      "Action": ["iam:PutRolePolicy", "iam:TagRole", "iam:UntagRole"],
      "Resource": "arn:aws:iam::396287094661:role/githubdeploy-*",
      "Condition": {
        "ArnLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/hcptf-shoc-backend-*", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-*"] },
        "StringNotEquals": { "aws:ResourceTag/HcpTerraformWorkspace": "${aws:PrincipalTag/HcpTerraformWorkspace}" }
      }
    },
    {
      "Sid": "LockHcpTerraformWorkspaceTag",
      "Effect": "Deny",
      "Action": ["iam:TagRole", "iam:UntagRole"],
      "Resource": "arn:aws:iam::396287094661:role/*",
      "Condition": {
        "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*"] },
        "ForAnyValue:StringEquals": { "aws:TagKeys": "HcpTerraformWorkspace" }
      }
    }
  ]
}