data_perimeter_governance_policy_1.json

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "PreventRAMExternalResourceShare",
         "Effect": "Deny",
         "Action": [
            "ram:CreateResourceShare",
            "ram:UpdateResourceShare"
         ],
         "Resource": "*",
         "Condition": {
            "StringNotEqualsIfExists": {
               "aws:PrincipalTag/dp:exclude:identity": "true"
            },
            "Bool": {
               "ram:RequestedAllowsExternalPrincipals": "true"
            }
         }
      },
      {
         "Sid": "PreventExternalResourceShare",
         "Effect": "Deny",
         "Action": [
            "ec2:ModifyImageAttribute",
            "ec2:ModifyFPGAImageAttribute",
            "ec2:ModifySnapshotAttribute",
            "ec2:ModifyVpcEndpointServicePermissions",
            "ssm:ModifyDocumentPermission",
            "rds:ModifyDBSnapshotAttribute",
            "rds:ModifyDBClusterSnapshotAttribute",
            "redshift:AuthorizeDataShare",
            "redshift:AuthorizeSnapshotAccess",
            "ds:ShareDirectory",
            "logs:PutSubscriptionFilter",
            "lakeformation:GrantPermissions",
            "lakeformation:BatchGrantPermissions",
            "appstream:UpdateImagePermissions",
            "macie2:CreateInvitations",
            "securityhub:CreateMembers",
            "securityhub:InviteMembers",
            "guardduty:CreateMembers",
            "guardduty:InviteMembers",
            "auditmanager:StartAssessmentFrameworkShare",
            "docdb:ModifyDBClusterSnapshots"
         ],
         "Resource": "*",
         "Condition": {
            "StringNotEqualsIfExists": {
               "aws:PrincipalTag/dp:exclude:identity": "true"
            }
         }
      },
      {
         "Sid": "ProtectActionsNotSupportedByPrimaryDPControls",
         "Effect": "Deny",
         "Action": [
            "ec2:CreateTransitGatewayPeeringAttachment",
            "ec2:AcceptTransitGatewayPeeringAttachment",
            "ec2:RejectTransitGatewayPeeringAttachment",
            "ec2:DeleteTransitGatewayPeeringAttachment",
            "ec2:CreateVpcPeeringConnection",
            "ec2:AcceptVpcPeeringConnection",
            "ec2:RejectVpcPeeringConnection",
            "ec2:DeleteVpcPeeringConnection",
            "ec2:CreateVpcEndpoint",
            "ec2:AcceptVpcEndpointConnections",
            "ec2:RejectVpcEndpointConnections",
            "ec2:CopyImage",
            "ec2:CopyFpgaImage",
            "ec2:CopySnapshot",
            "ec2:CreateVolume",
            "route53:CreateVPCAssociationAuthorization",
            "route53:AssociateVPCWithHostedZone",
            "route53:DisassociateVPCFromHostedZone",
            "route53:ListHostedZonesByVPC",
            "route53:DeleteVPCAssociationAuthorization",
            "macie2:AcceptInvitation",
            "securityhub:AcceptAdministratorInvitation",
            "guardduty:AcceptAdministratorInvitation",
            "auditmanager:UpdateAssessmentFrameworkShare",
            "es:AcceptInboundConnection",
            "es:CreateOutboundConnection"
         ],
         "Resource": "*",
         "Condition": {
            "StringNotEqualsIfExists": {
               "aws:PrincipalTag/dp:exclude:resource": "true"
            }
         }
      },
      {
         "Sid": "PreventPublicBucketACL",
         "Effect": "Deny",
         "Action": [
            "s3:PutBucketAcl",
            "s3:CreateBucket"
         ],
         "Resource": "*",
         "Condition": {
            "StringEquals": {
               "s3:x-amz-acl": [
                  "public-read",
                  "public-read-write"
               ]
            },
            "StringNotEqualsIfExists": {
               "aws:PrincipalTag/dp:exclude:identity": "true"
            }
         }
      },
      {
         "Sid": "PreventS3PublicAccessBlockConfigurations",
         "Effect": "Deny",
         "Action": "s3:PutAccountPublicAccessBlock",
         "Resource": "*",
         "Condition": {
            "StringNotEqualsIfExists": {
               "aws:PrincipalTag/dp:exclude:identity": "true"
            }
         }
      },
      {
         "Sid": "ProtectDataPerimeterTags",
         "Effect": "Deny",
         "Action": "*",
         "Resource": "*",
         "Condition": {
            "StringNotEqualsIfExists": {
               "aws:PrincipalTag/team": "admin"
            },
            "ForAnyValue:StringEquals": {
               "aws:TagKeys": [
                  "dp:*",
                  "team"
               ]
            }
         }
      }
   ]
}