Home / server / Questions / 963599
Accepted
Tim
Asked: 2019-04-18 19:18:30 +0800 CST

Enforcing EBS Encryption within AWS Organization using SCP (Service Control Policy)

  • 772

Is it possible to enforce that all accounts within an AWS organization can only create encrypted EBS volumes?

I know you can enforce it using IAM roles, but I want to know if it can be done with SCP.

Here's what I've come up with so far, but it doesn't work. I've attached this to an account within my organisation but I can create both encrypted and unencrypted volumes.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "ec2:CreateVolume",
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "ec2:Encrypted": "false"
                }
            }
        }
    ]
}
amazon-web-services

1 Answers

  1. Best Answer

    Updated Sept 2020

    The information on the AWS page linked below has changed. The limitation around EC2 and root users appears to have been removed. The following policy should work

    {
  "Effect": "Deny",
  "Action": "ec2:CreateVolume",
  "Resource": "*",
  "Condition": {
    "Bool": {
      "ec2:Encrypted": "false"
    }
  }
},
{
  "Sid": "PreventEc2MountUnencryptedVolume",
  "Effect": "Deny",
  "Action": "ec2:RunInstances",
  "Resource": "arn:aws:ec2:*:*:volume/*",
  "Condition": {
    "Bool": {
      "ec2:Encrypted": "false"
     }
   }
}

    You can and probably should restrict the root user more generally using a policy such as the one found on this page. The root user shouldn't be used for routine administration, but having them available and with permissions to do key tasks as a break-glass is sensible.

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RestrictEC2ForRoot",
      "Effect": "Deny",
      "Action": [
        "ec2:*",
        "s3:*",
        "kms:*"
      ],
      "Resource": [
        "*"
      ],    
      "Condition": {
        "StringLike": {
          "aws:PrincipalArn": [
            "arn:aws:iam::*:root"
          ]
        }
      }
    }
  ]
}

    Original Answer April 2019

    It turns out that SCP works as expected, but there's a catch - according to this AWS page "All condition keys that start with "ec2" aren't evaluated when using root credentials".

    Because the requirement for the volume to be encrypted is within a condition key it was not enforced while I was logged in as root. When I logged in as an IAM user the SCP was enforced as expected.

    Here's the full text from the AWS documentation.

    AWS Docs

    Currently, when using root user credentials to make Amazon EC2 requests, the resource and condition policy elements don't function as expected in the following ways:

    Resource ARNs – If you specify an AWS resource ARN in an SCP's resource element, it won't match the resource the root user performs

    the Amazon EC2 action on during policy evaluation. This means that the specified restrictions for this action don't apply to the root user. Deny statements that specify all resources ("Resource": "*") for Amazon EC2 actions are correctly evaluated for root users.

    Amazon EC2 condition keys – All condition keys that start with "ec2" aren't evaluated when using root credentials. Because policy

    conditions aren't correctly evaluated for root users, users with root credentials might have unintended access to Amazon EC2 actions.

    This issue doesn't affect IAM users and roles or any AWS service except Amazon EC2. Only the root user is subject to this issue. If you don’t want your root user to have access to Amazon EC2 actions, attach an SCP like the Restrict Access to Amazon EC2 for Root User example to your organization root.

    Here's the SCP they link to

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RestrictEC2ForRoot",
      "Effect": "Deny",
      "Action": [
        "ec2:*"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringLike": {
          "aws:PrincipalArn": [
            "arn:aws:iam::*:root"
          ]
        }
      }
    }
  ]
}
    • 0