aws-samples / aws-samples/data-perimeter-policy-examples

Resource Explorer service views missing from NotResource list in resource_perimeter_scp.json

Open
#58 5 comments 0 reactions 1 assignee Claimed by @liwadman View on GitHub
Dominant language
No language data
Stars
211
Forks
35
Avg merge
1d 5h
Merged PRs (30d)
1

Description

## Problem

AWS Resource Explorer service views are AWS-owned resources (empty account field in the ARN), but they are not listed in the `NotResource` element of `EnforceResourcePerimeterAWSResources`. This causes `resource-explorer-2:Search` to be denied by the SCP.

Error:

```
User: arn:aws:sts:::assumed-role// is not authorized to perform:
resource-explorer-2:Search on resource:
arn:aws:resource-explorer-2:::view/AWSServiceViewForResourceExplorer/service-view
with an explicit deny in a service control policy
```

## Proposed Fix

Add the following to the `NotResource` list in `EnforceResourcePerimeterAWSResources`:

```
"arn:aws:resource-explorer-2:*::view/*"
```
or maybe preferably this - it depends on how AWS manages Resource Explorer Service Views:
```
"arn:aws:resource-explorer-2:*::view/AWSServiceViewForResourceExplorer/*"
```

And add a corresponding entry to `service_owned_resources.md`:

| Resource type | Resource owner | Resource ARN | Description | Policy example |
|---|---|---|---|---|
| AWS Resource Explorer view | AWS Resource Explorer | `arn:aws:resource-explorer-2:*::view/*` | Resource Explorer maintains [service views](https://docs.aws.amazon.com/resource-explorer/latest/userguide/aws-service-views.html) that are AWS-owned views enabling resource search in the AWS Console. | [resource_perimeter_scp.json](service_control_policies/resource_perimeter_scp.json) |

Kiro assisted a human in this analysis

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.