Delegating SCP Administration to Governance Workforce through AWS Organizations | by Teri Radichel | Cloud Safety | Jan, 2023

January 26, 2023

1

ACM.141 Delegated AWS Organizations Administrator — Coverage as Code

It is a continuation of my collection on Automating Cybersecurity Metrics.

I’ve been writing about easy methods to delegate permission to handle SCPs to our governance workforce. A technique to try this is through a delegated administrator.

Within the final publish I reverse-engineered the knowledge that I hope will work in that coverage:

Now let’s see if we are able to get it working.

Grant entry to group sources

We’re going to wish to to start with grant entry to the governance account to handle organizational sources:

Grant entry to handle SCPs

Subsequent we wish to create a coverage like this however we have to change the situation to our SCPs and the useful resource to our organizational SCPs.

Within the above coverage we have to change the related bits to match SCPs as an alternative of backup insurance policies. Within the final publish we found out that the situation for BACKUP_POLICY would possibly relate to this snippet — although it doesn’t have the bit about organizations.

Observe the situation of the situation above and to which actions it applies. I believe this coverage might have a difficulty. the situation looks like it’s extraneous and may not accurately apply to these actions. Within the pattern coverage under on one other web page within the AWS documentation, the situation is in a distinct location and applies to totally different actions.

I doubt any instrument goes to find all these nuances for you.

We additionally found out that the ARN for a Service Management Coverage is structured like this:

Effectively, we’d not even want the situation, if we wish to enable the governance workforce to handle Service Management Insurance policies for the complete group. The ARN itself has service_control_policy in it. So let’s strive it with out the situation first.

Tips on how to apply the delegated administrator coverage to your AWS Group

Observe that I eliminated a rabbit gap I went down making an attempt to imitate automating this in a brand new account. For causes I’ll clarify in a separate weblog publish, I’m going to do that manually for now in my present account with a person who has the mandatory permissions.

Yow will discover each handbook and automatic directions on this web page:

Navigate to AWS Organizations. Click on Settings.

Underneath Delegated administrator for AWS Organizations click on Delegate.

Copy and paste within the coverage that enables your new account to view group sources from this web page:

I modified the SID (title or ID) to one thing that makes extra sense to me.

Change the AccountId within the coverage to whichever account quantity you want to delegate entry.

Discover that it’s granting entry to the “root” person which doesn’t solely imply the Account AWS precise root use but in addition directors within the account. In case you have considerations about how who has entry it’s best to do some testing to find out who has entry and who doesn’t in that account.

In my case, I’m going to solely create one position on this account for the governance directors on this account and I’ll must make it possible for position has entry once I get to it. As famous in a previous publish we are able to additionally apply restrictions on the basis account in each AWS account utilizing an SCP. Extra on that later.

Now right here’s one thing I didn’t suppose would occur. We’re going to finish up with a monolithic coverage right here as a result of what occurs is that single coverage will get added to the Organizations’s settings. As a substitute of making totally different insurance policies for various kinds of entry we’re going to have to use it in a single single coverage such as you do while you create an S3 bucket.

I suppose I used to be anticipating we may create totally different insurance policies for various AWS Organizations delegated directors. However it aligned with how S3 bucket insurance policies work so it is smart. In any case, let’s log into the governance account and see if we are able to view the group info utilizing a person that has admin entry.

Sure I can, although I’m not precisely positive if this permission is granted by means of an AWS SSO position.

I navigate to a different account with the identical permission set, and on this case, I can not view the insurance policies, so this appears to work:

Now let’s see if we an edit an SCP, again within the governance account.

No, so our coverage works as anticipated.

Now let’s add the permissions to handle the SCPs.

Discover the Governance account additionally can not see the group’s settings:

Return to the basis account and edit the coverage we created above.

We’re going to insert a brand new assertion as a result of the prior assertion applies to all (*) sources in our group. the brand new assertion is barely going to use to SCPs (hopefully). Add a comma after the prevailing assertion and a brand new open and shut bracket. The textual content “#new coverage right here” reveals you the place we’re going to insert the brand new coverage code.

Let’s use a modified model of this coverage that grants permission to handle backup insurance policies:

Now I checked out changing the situation within the above coverage however discover to which actions the situation utilized above? What’s that situation relevant to within the coverage from within the pattern code under? The 2 totally different examples from the AWS documentation have the situation in two totally different locations.

The situation under seems to restrict the delegated administrator to viewing the organizational sources associated to backup insurance policies. The code within the prior instance was utilized to the actions associated to insurance policies. For my functions, I’m going to let my governance account view any organizational info so we don’t really want that situation. We don’t want a situation on insurance policies as a result of the ARN we’re going to use solely applies to service management insurance policies.

We’ve already added the remainder of the highest portion of this coverage, so we simply must insert the second assertion on this coverage into the coverage we simply added to our group, however we wish to substitute the 4 ARNs with the service management coverage ARN. You’ll must set your account quantity within the assertion under as nicely, to interchange the X’s underlined in pink.

Once I examined my coverage the above coverage assertion saved efficiently however didn’t work. I examined first with a single ARN. Then I changed the group particular items one after the other with *.

Right here’s my coverage working:

(Bear in mind to vary the account numbers.)

{
"Model": "2012-10-17",
"Assertion": [
{
"Sid": "ViewAWSOrganizationsResources",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::XXXXXXXXXXXX:root"
},
"Action": [
"organizations:DescribeOrganization",
"organizations:DescribeOrganizationalUnit",
"organizations:DescribeAccount",
"organizations:DescribePolicy",
"organizations:DescribeEffectivePolicy",
"organizations:ListRoots",
"organizations:ListOrganizationalUnitsForParent",
"organizations:ListParents",
"organizations:ListChildren",
"organizations:ListAccounts",
"organizations:ListAccountsForParent",
"organizations:ListPolicies",
"organizations:ListPoliciesForTarget",
"organizations:ListTargetsForPolicy",
"organizations:ListTagsForResource"
],
"Useful resource": "*"
},
{
"Sid": "DelegatingAllActionsForServiceControlPolicies",
"Impact": "Enable",
"Principal": {
"AWS": "arn:aws:iam::XXXXXXXXXXXX:root"
},
"Motion": [
"organizations:CreatePolicy",
"organizations:UpdatePolicy",
"organizations:DeletePolicy",
"organizations:AttachPolicy",
"organizations:DetachPolicy",
"organizations:EnablePolicyType",
"organizations:DisablePolicyType"
],
"Useful resource": "arn:aws:organizations::*:coverage/*/service_control_policy/*"
}
]
}

With the above coverage the governance account is ready to handle service management insurance policies, together with these created by Management Tower and those created by the basis person within the root account.

The governance workforce can not change the organizational coverage settings with these permissions or handle different kinds of insurance policies.

Comply with for updates.

Teri Radichel

If you happen to preferred this story ~ clap, comply with, tip, purchase me a espresso, or rent me.

Medium: Teri Radichel
E mail Record: Teri Radichel
Twitter: @teriradichel
Twitter (firm): @2ndSightLab
Mastodon: @teriradichel@infosec.trade
Put up: @teriradichel
Fb: 2nd Sight Lab
Slideshare: Shows by Teri Radichel 
Speakerdeck: Shows by Teri Radichel
Books: Teri Radichel on Amazon
Recognition: SANS Distinction Makers Award, AWS Hero, IANS College
Certifications: SANS
Schooling: BA Enterprise, Grasp of Sofware Engineering, Grasp of Infosec
How I obtained into safety: Girl in tech
Purchase me a espresso: Teri Radichel
Firm (Penetration Exams, Assessments, Coaching): 2nd Sight Lab
Request companies through LinkedIn: Teri Radichel or IANS Analysis