diff --git a/README.md b/README.md index 4a00cc3..8638463 100644 --- a/README.md +++ b/README.md @@ -15,6 +15,8 @@ A repository of community generated Service control policies (SCPs) and referenc - [prevent-deletion-of-service-resources](prevent-deletion-of-service-resources.policy) - Protect various organizational roles and resources curated for service and governance related purposes. +- [s3-us-only-buckets](s3-us-only-buckets.policy) - Allows creation of an S3 bucket only in the US EAST (us-east-1 or us-east-2) or WEST (us-west-1 or us-west-2) regions. + ## Reference Links - [Service Control Policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html) - AWS Organizations - Service Control Policies Documentation diff --git a/s3-us-only-buckets.policy b/s3-us-only-buckets.policy new file mode 100644 index 0000000..2914f3f --- /dev/null +++ b/s3-us-only-buckets.policy @@ -0,0 +1,23 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "AllowOnlyUSBasedS3Buckets", + "Effect": "Deny", + "Action": [ + "s3:CreateBucket" + ], + "Resource": "arn:aws:s3:::*", + "Condition": { + "ForAnyValue:StringNotLike": { + "s3:LocationConstraint": [ + "us-east-1", + "us-east-2", + "us-west-1", + "us-west-2" + ] + } + } + } + ] +} \ No newline at end of file