mirror of
https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git
synced 2026-09-30 09:13:17 +00:00
10e66c92c0
cdk import by Id (non-mutating), content byte-exact from describe-policy, targetIds = exact live attachments. Post-import drift detection: IN_SYNC, 0 drifted. All four Retain — the full org guardrail set is now drift-checked IaC.
26 lines
1 KiB
JSON
26 lines
1 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "DenyDisablingSecurityServices",
|
|
"Effect": "Deny",
|
|
"Action": [
|
|
"cloudtrail:StopLogging", "cloudtrail:DeleteTrail", "cloudtrail:UpdateTrail",
|
|
"guardduty:DeleteDetector", "guardduty:UpdateDetector", "guardduty:DisassociateFromMasterAccount",
|
|
"config:StopConfigurationRecorder", "config:DeleteConfigurationRecorder", "config:DeleteDeliveryChannel",
|
|
"securityhub:DisableSecurityHub", "securityhub:BatchDisableStandards",
|
|
"accessanalyzer:DeleteAnalyzer", "inspector2:Disable"
|
|
],
|
|
"Resource": "*",
|
|
"Condition": {
|
|
"ArnNotLike": { "aws:PrincipalArn": [
|
|
"arn:aws:iam::396287094661:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::396287094661:role/cdk-hnb659fds-*",
|
|
"arn:aws:iam::396287094661:role/seahaven-extdev-config-custom-resource-role"
|
|
]}
|
|
}
|
|
},
|
|
{ "Sid": "DenyLeavingOrganization", "Effect": "Deny", "Action": ["organizations:LeaveOrganization"], "Resource": "*" }
|
|
]
|
|
}
|
|
|