How AWS Service Control Policies Can Protect Security Baselines
Summary
The article shows how AWS Service Control Policies can help prevent changes to security baselines, including IAM roles, CloudTrail, GuardDuty, organization membership, root access, and account contact information.
Key points
- SCPs can deny changes to designated baseline IAM roles, with exceptions for specified deployment roles.
- Example policies restrict actions that could disable or alter CloudTrail and GuardDuty protections.
- The article recommends preventing member accounts from leaving the organization to avoid bypassing its SCPs.
- A policy example denies root-user actions, with an exemption for a designated account.
- Another policy denies changes to account contact information, which the article identifies as a takeover-risk reduction measure.
- The author cautions that SCPs can cause usability and debugging problems, and recommends considering exceptions carefully.
Article Details
- Defense Focus
- Use AWS Organizations Service Control Policies (SCPs) to prevent changes to security baselines, including IAM roles, CloudTrail, GuardDuty, organization membership, root-user access, and account contact information.
- Detection Methods
- Periodically audit accounts for required baseline settings and alert when assertions are no longer true.
- Use SCPs to deny actions that modify or remove protected roles and security services.
- Data Sources
- AWS account configuration
- CloudTrail configuration
- GuardDuty configuration
- IAM role and policy configuration
- AWS Organizations membership and account settings
- Rule Types
- AWS Organizations Service Control Policies (SCPs)
- Platforms
- AWS
- Defensive Actions
- Apply SCPs that deny modification or deletion of designated baseline IAM roles, with narrowly scoped exceptions for authorized deployment roles.
- Deny disabling or modifying protected CloudTrail trails and GuardDuty settings; configure the example trail name and management account ID for the environment.
- Deny accounts from leaving the organization that enforces the SCPs.
- Restrict root-user actions where appropriate, retaining only necessary account-specific exceptions.
- Deny changes to approved account contact information and alternate contacts.
- Continue periodic baseline audits and use alerting or auto-remediation to identify and correct configuration drift.
- Test SCP usability and exceptions carefully; combine statements where policy-count limits require it.
Products
Amazon GuardDutyyou first create a new AWS account in your organization, you likely want to ensure that CloudTrail and GuardDuty are enabled, and certain IAM roles exist in the account for your vendors or your own access. You have anAWS Organizationswhen actions are denied. In an earlier blog post we showed how to use Delegated Administrator for AWS Organizations to give engineers visibility into the SCPs being applied to them if you want to do such a thing. CloudTrailexample, when you first create a new AWS account in your organization, you likely want to ensure that CloudTrail and GuardDuty are enabled, and certain IAM roles exist in the account for your vendors or your ownIAMin your organization, you likely want to ensure that CloudTrail and GuardDuty are enabled, and certain IAM roles exist in the account for your vendors or your own access. You have an expectation that those things