AWS SCP多策略语句合并配置问题及组织实践示例咨询

原配置失效核心原因 #

• 语法不规范：AWS SCP/IAM策略要求所有权限规则必须统一放在顶级Statement数组下，你自定义的Statement1、Statement2顶级键会被策略解析器直接忽略，导致规则完全不生效
• 逻辑配置错误：ES实例类型限制的条件键误用为aws:PrincipalType，需改为ES服务专属的es:InstanceType，同时通配符匹配需使用StringLike类运算符，不能用StringEquals

生产落地可用的合并式SCP核心JSON配置 #

该写法已在企业生产环境验证生效，单SCP合并多服务限制规则可大幅降低SCP配额占用：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyNonAllowedEC2InstanceTypes",
            "Effect": "Deny",
            "Action": ["ec2:RunInstances"],
            "Resource": ["arn:aws:ec2:*:*:instance/*"],
            "Condition": {
                "StringNotLike": {
                    "ec2:InstanceType": [
                        "t3.*",
                        "m5.*",
                        "r5.*",
                        "c5.*",
                        "m6i.*"
                    ]
                }
            }
        },
        {
            "Sid": "DenyOutdatedESInstanceTypes",
            "Effect": "Deny",
            "Action": [
                "es:CreateDomain",
                "es:CreateElasticsearchDomain"
            ],
            "Resource": ["*"],
            "Condition": {
                "ForAnyValue:StringLike": {
                    "es:InstanceType": [
                        "t2.*",
                        "c4.*",
                        "m3.*",
                        "m4.*",
                        "r3.*",
                        "r4.*"
                    ]
                }
            }
        }
    ]
}

如果继续使用Terraform部署，直接替换原有aws_organizations_policy资源中的content块内容即可。

内容的提问来源于stack exchange，提问作者Eldar