Source: AWS Security Blog
Author: Swara Gandhi
URL: https://aws.amazon.com/blogs/security/unlock-new-possibilities-aws-organizations-service-control-policy-now-supports-full-iam-language/
ONE SENTENCE SUMMARY:
AWS Organizations now supports full IAM policy language for Service Control Policies, enhancing permission management with new elements and flexibility.
MAIN POINTS:
- AWS Organizations now offers full IAM policy language support for SCPs.
- New features include conditions, resource ARNs, and wildcards in SCPs.
- Enhanced permission management simplifies policy designs and reduces operational overhead.
- NotResource element allows broad deny-by-default policies with scoped exceptions.
- Updated SCPs improve clarity and simplicity compared to previous implementations.
- Wildcard support expands to beginning/middle of Action or NotAction strings.
- Allow statements can now use conditions for more precise access control.
- Explicit Deny statements are recommended to ensure security best practices.
- IAM Access Analyzer validates SCPs for security and compliance before deployment.
- Enhanced SCP capabilities align with IAM policies for better access control.
TAKEAWAYS:
- Full IAM policy language in SCPs improves precision and policy expressiveness.
- NotResource elements simplify deny-by-default policy structures.
- Support for conditions in Allow statements enhances targeted access control.
- Wildcards in Action/NotAction elements offer greater flexibility.
- IAM Access Analyzer aids in secure and compliant policy deployment.