scp-policy

gistfile1.txt

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyAllOutsideEU",
            "Effect": "Deny",
            "NotAction": [
                "a4b:*",
                "access-analyzer:Get*",
                "access-analyzer:List*",
                "access-analyzer:StartPolicyGeneration",
                "access-analyzer:ValidatePolicy",
                "account:EnableRegion",
                "account:Get*",
                "account:List*",
                "acm:*",
                "artifact:Get*",
                "artifact:List*",
                "artifact:Download*",
                "aws-portal:Get*",
                "aws-portal:View*", 
                "aws-portal:ModifyAccount", 
                "billing:Get*",
                "billing:List*",
                "ce:*",
                "budgets:*",
                "chime:*",
                "cloudformation:*",
                "cloudfront:*",
                "cloudfront-keyvaluestore:*",
                "cloudtrail:Describe*",
                "cloudtrail:List*",
                "cloudtrail:Get*",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:GetMetricData",
                "cloudwatch:ListMetrics",
                "cloudwatch:PutMetricAlarm",
                "cognito-idp:List*",
                "compute-optimizer:Get*",
                "compute-optimizer:Export*",
                "config:*",
                "consolidatedbilling:GetAccountBillingRole",
                "cost-optimization-hub:*",
                "cur:*",
                "devicefarm:*",
                "directconnect:*",
                "ec2:DescribeRegions",
                "ec2:DescribeTransitGateways",
                "ec2:DescribeVpnGateways",
                "fms:*",
                "freetier:GetFreeTierUsage",
                "globalaccelerator:*",
                "health:*",
                "iam:*",
                "importexport:*",
                "invoicing:ListInvoiceSummaries",
                "logs:DescribeLogGroups",
                "kms:*",
                "mapcredits:ListAssociatedPrograms",
                "mobileanalytics:*",
                "networkmanager:*",
                "organizations:*",
                "panorama:Get*",
                "panorama:List*",
                "payments:List*",
                "payments:Get*",
                "pricing:*",
                "quicksight:*",
                "route53:*",
                "route53-recovery-readiness:List*", 
                "route53-recovery-control-config:List*",
                "route53domains:*",
                "s3:GetAccountPublic*",
                "s3:GetBucketLocation*",
                "s3:GetStorageLensConfiguration",
                "s3:GetStorageLensDashboard",
                "s3:List*",                
                "savingsplans:DeleteQueuedSavingsPlan",
                "savingsplans:Describe*",
                "shield:*",
                "ssm:Get*",
                "sts:*",
                "sustainability:GetCarbonFootprintSummary",
                "support:*",
                "tax:ListTaxRegistrations",
                "trustedadvisor:*",
                "waf-regional:*",
                "waf:*",
                "wafv2:*",
                "wellarchitected:*"
            ],
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "eu-central-1",
                        "eu-west-1",
                        "eu-south-1",
                        "eu-west-3"
                    ]
                },
                "StringNotLike": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_MasterAdmin_*",
                        "arn:aws:iam::*:role/stacksets-exec-*"
                    ]
                }
            }
        }    
    ]
}