{"id":13618645,"url":"https://github.com/Appsilon/terraform-aws-ou-scp","last_synced_at":"2025-04-14T13:31:30.415Z","repository":{"id":48414741,"uuid":"377161790","full_name":"Appsilon/terraform-aws-ou-scp","owner":"Appsilon","description":null,"archived":true,"fork":false,"pushed_at":"2023-11-13T22:14:37.000Z","size":73,"stargazers_count":0,"open_issues_count":7,"forks_count":1,"subscribers_count":4,"default_branch":"main","last_synced_at":"2024-08-02T21:38:35.150Z","etag":null,"topics":["terraform-module"],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Appsilon.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2021-06-15T12:52:43.000Z","updated_at":"2023-11-27T09:57:51.000Z","dependencies_parsed_at":"2023-01-22T21:30:25.899Z","dependency_job_id":"57956c66-296c-4ebc-afae-be4aa161b906","html_url":"https://github.com/Appsilon/terraform-aws-ou-scp","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":"Appsilon/terraform-module-template","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Appsilon%2Fterraform-aws-ou-scp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Appsilon%2Fterraform-aws-ou-scp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Appsilon%2Fterraform-aws-ou-scp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Appsilon%2Fterraform-aws-ou-scp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Appsilon","download_url":"https://codeload.github.com/Appsilon/terraform-aws-ou-scp/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223633399,"owners_count":17176805,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["terraform-module"],"created_at":"2024-08-01T21:00:28.070Z","updated_at":"2024-11-08T04:31:14.911Z","avatar_url":"https://github.com/Appsilon.png","language":"HCL","funding_links":[],"categories":["terraform modules"],"sub_categories":["service control policies"],"readme":"## AWS OU SCP Terraform Module\n\nModule initially comes from [Trussworks](https://github.com/trussworks/terraform-aws-ou-scp) and is adjusted to reflect Appsilon custom policies, like `require_ec2_tags` i.e.\n\nSupports two main use cases:\n\n* Combines multiple Service Control Policy (SCP) statements - combining multiple policy statements into a single policy allows more than 5 policies to be be applied to a single Organizational Unit (OU).\n* Alternatively, creates a \"Deny All Access\" Service Control Policy.\n\n Alternatively, enables creation of a \"Deny All Access\" Service Control Policy.\n\nPolicy options (listed by `sid`) are:\n\n* Deny leaving AWS Organizations (DenyLeavingOrgs)\n* Deny creating IAM users or access keys (DenyCreatingIAMUsers)\n* Deny deleting KMS Keys (DenyDeletingKMSKeys)\n* Deny deleting Route53 Hosted Zones (DenyDeletingRoute53Zones)\n* Deny deleting VPC Flow logs, Cloudwatch log groups, and Cloudwatch log streams (DenyDeletingCloudwatchLogs)\n* Deny root account (DenyRootAccount)\n* Protect S3 Buckets (ProtectS3Buckets)\n* Deny S3 Buckets Public Access (DenyS3BucketsPublicAccess)\n* Protect IAM Roles (ProtectIAMRoles)\n* Restrict Regional Operations (LimitRegions)\n* Require S3 encryption (DenyIncorrectEncryptionHeader + DenyUnEncryptedObjectUploads)\n\n### Usage for combined policy statements\n\nTo include a policy in your combined policy block, set it to `true`. Otherwise omit the policy variable.\n\n```hcl\nmodule \"github_terraform_aws_ou_scp\" {\n  source = \"appsilon/ou-scp/aws\"\n  target =  aws_organizations_organizational_unit.my_ou\n\n  # don't allow all accounts to be able to leave the org\n  deny_leaving_orgs             = true\n  # applies to accounts that are not managing IAM users\n  deny_creating_iam_users       = true\n  # don't allow deleting KMS keys\n  deny_deleting_kms_keys        = true\n  # don't allow deleting Route53 zones\n  deny_deleting_route53_zones   = true\n  # don't allow deleting CloudWatch logs\n  deny_deleting_cloudwatch_logs = true\n  # don't allow access to the root user\n  deny_root_account             = true\n\n  protect_s3_buckets            = true\n  # protect terraform statefile bucket\n  protect_s3_bucket_resources   = [\n    \"arn:aws:s3:::prod-terraform-state-us-west-2\",\n    \"arn:aws:s3:::prod-terraform-state-us-west-2/*\"\n  ]\n\n  # don't allow public access to bucket\n  deny_s3_buckets_public_access = true\n  deny_s3_bucket_public_access_resources = [\n    \"arn:aws:s3:::log-delivery-august-2020\"\n  ]\n\n  protect_iam_roles             = true\n  # - protect OrganizationAccountAccessRole\n  protect_iam_role_resources     = [\n    \"arn:aws:iam::*:role/OrganizationAccountAccessRole\"\n  ]\n\n  # restrict region-specific operations to us-west-2\n  limit_regions                 = true\n  # - restrict region-specific operations to us-west-2\n  allowed_regions               = [\"us-west-2\"]\n\n  # require s3 objects be encrypted\n  require_s3_encryption = true\n\n  # SCP policy tags\n  tags = {\n    managed_by = \"terraform\"\n  }\n}\n```\n\n### Usage for a policy which denies all access\n\n```hcl\nmodule \"github_terraform_aws_ou_scp\" {\n  source = \"appsilon/ou-scp/aws\"\n  target =  aws_organizations_organizational_unit.my_ou\n\n  # don't allow any access at all\n  deny_all=true\n}\n```\n\n\u003c!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.0.0 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 3.45.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | 3.45.0 |\n\n## Modules\n\nNo modules.\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_organizations_policy.generated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource |\n| [aws_organizations_policy_attachment.generated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy_attachment) | resource |\n| [aws_iam_policy_document.combined_policy_block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.deny_all_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_allowed_regions\"\u003e\u003c/a\u003e [allowed\\_regions](#input\\_allowed\\_regions) | AWS Regions allowed for use (for use with the restrict regions SCP) | `list(string)` | \u003cpre\u003e[\u003cbr\u003e  \"\"\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_deny_all\"\u003e\u003c/a\u003e [deny\\_all](#input\\_deny\\_all) | If false, create a combined policy. If true, deny all access | `bool` | `false` | no |\n| \u003ca name=\"input_deny_creating_iam_users\"\u003e\u003c/a\u003e [deny\\_creating\\_iam\\_users](#input\\_deny\\_creating\\_iam\\_users) | DenyCreatingIAMUsers in the OU policy. | `bool` | `false` | no |\n| \u003ca name=\"input_deny_deleting_cloudwatch_logs\"\u003e\u003c/a\u003e [deny\\_deleting\\_cloudwatch\\_logs](#input\\_deny\\_deleting\\_cloudwatch\\_logs) | DenyDeletingCloudwatchLogs in the OU policy. | `bool` | `false` | no |\n| \u003ca name=\"input_deny_deleting_kms_keys\"\u003e\u003c/a\u003e [deny\\_deleting\\_kms\\_keys](#input\\_deny\\_deleting\\_kms\\_keys) | DenyDeletingKMSKeys in the OU policy. | `bool` | `false` | no |\n| \u003ca name=\"input_deny_deleting_route53_zones\"\u003e\u003c/a\u003e [deny\\_deleting\\_route53\\_zones](#input\\_deny\\_deleting\\_route53\\_zones) | DenyDeletingRoute53Zones in the OU policy. | `bool` | `false` | no |\n| \u003ca name=\"input_deny_leaving_orgs\"\u003e\u003c/a\u003e [deny\\_leaving\\_orgs](#input\\_deny\\_leaving\\_orgs) | DenyLeavingOrgs in the OU policy. | `bool` | `false` | no |\n| \u003ca name=\"input_deny_root_account\"\u003e\u003c/a\u003e [deny\\_root\\_account](#input\\_deny\\_root\\_account) | DenyRootAccount in the OU policy. | `bool` | `false` | no |\n| \u003ca name=\"input_deny_s3_bucket_public_access_resources\"\u003e\u003c/a\u003e [deny\\_s3\\_bucket\\_public\\_access\\_resources](#input\\_deny\\_s3\\_bucket\\_public\\_access\\_resources) | S3 bucket resource ARNs to block public access | `list(string)` | \u003cpre\u003e[\u003cbr\u003e  \"\"\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_deny_s3_buckets_public_access\"\u003e\u003c/a\u003e [deny\\_s3\\_buckets\\_public\\_access](#input\\_deny\\_s3\\_buckets\\_public\\_access) | DenyS3BucketsPublicAccess in the OU policy. | `bool` | `false` | no |\n| \u003ca name=\"input_limit_regions\"\u003e\u003c/a\u003e [limit\\_regions](#input\\_limit\\_regions) | LimitRegions in the OU policy. | `bool` | `false` | no |\n| \u003ca name=\"input_protect_iam_role_resources\"\u003e\u003c/a\u003e [protect\\_iam\\_role\\_resources](#input\\_protect\\_iam\\_role\\_resources) | IAM role resource ARNs to protect from modification and deletion | `list(string)` | \u003cpre\u003e[\u003cbr\u003e  \"\"\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_protect_iam_roles\"\u003e\u003c/a\u003e [protect\\_iam\\_roles](#input\\_protect\\_iam\\_roles) | ProtectIAMRoles in the OU policy. | `bool` | `false` | no |\n| \u003ca name=\"input_protect_s3_bucket_resources\"\u003e\u003c/a\u003e [protect\\_s3\\_bucket\\_resources](#input\\_protect\\_s3\\_bucket\\_resources) | S3 bucket resource ARNs to protect from bucket and object deletion | `list(string)` | \u003cpre\u003e[\u003cbr\u003e  \"\"\u003cbr\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_protect_s3_buckets\"\u003e\u003c/a\u003e [protect\\_s3\\_buckets](#input\\_protect\\_s3\\_buckets) | ProtectS3Buckets in the OU policy. | `bool` | `false` | no |\n| \u003ca name=\"input_require_ec2_tags\"\u003e\u003c/a\u003e [require\\_ec2\\_tags](#input\\_require\\_ec2\\_tags) | RequireTagsForEC2InstancesAndVolumes in the OU policy | `bool` | `false` | no |\n| \u003ca name=\"input_require_s3_encryption\"\u003e\u003c/a\u003e [require\\_s3\\_encryption](#input\\_require\\_s3\\_encryption) | DenyIncorrectEncryptionHeader and DenyUnEncryptedObjectUploads in the OU policy | `bool` | `false` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | Tags applied to the SCP policy | `map(string)` | `{}` | no |\n| \u003ca name=\"input_target\"\u003e\u003c/a\u003e [target](#input\\_target) | OU resource to attach SCP | \u003cpre\u003eobject({\u003cbr\u003e    name = string\u003cbr\u003e    id   = string\u003cbr\u003e  })\u003c/pre\u003e | n/a | yes |\n\n## Outputs\n\nNo outputs.\n\u003c!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n\n## Developer Setup\n\nInstall dependencies (macOS)\n\n```shell\nbrew install pre-commit go terraform terraform-docs\npre-commit install --install-hooks\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FAppsilon%2Fterraform-aws-ou-scp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FAppsilon%2Fterraform-aws-ou-scp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FAppsilon%2Fterraform-aws-ou-scp/lists"}