aws service control policies in organization - preventing user from creating s3 bucket in a region

 

For those coming from Azure, Aws account is a subscription. So in this walk-through we are going to create another new account called with number xxxxxxxx. You would have another account which is the management account  (yyyyyyyyyy). SCP does not applies to the management yyyyyyyy account.

Assuming you already have this AWS created and a user called "mark" who is tied to xxxxxx account. 

Please note: The user from yyyyyy account are exempted

To create your AWS service control policies, goto AWS Organization and then -> Policies -> Service Control Policies (please make sure you enable it) 

Next, click on "Create policy" and add the following in the policy and click "create".

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PreventS3CreationInApSoutheast1",
      "Effect": "Deny",
      "Action": [
        "s3:CreateBucket"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "s3:LocationConstraint": "ap-southeast-1"
        }
      }
    }
  ]
}

This is the error you will get when mark trying to create a s3 bucket in ap-southeast-1 (singapore) region. Once it is created, we will attach it - select the "Targets" tab and then click on "Attach". As you can see here, I have attached it to bm account. 

This is an example of the error that mark will get 

User: arn:aws:iam::xxxxxxxxxxx:user/mark is not authorized to perform: s3:CreateBucket on resource: "arn:aws:s3:::testdemoappainika" with an explicit deny in a service control policy: arn:aws:organizations::yyyyyyyyyyyyy:policy/o-7hy7s17yq9/service_control_policy/p-p1jlzjlk