aws-samples / aws-samples/data-perimeter-policy-examples
Resource Explorer service views missing from NotResource list in resource_perimeter_scp.json
- Dominant language
- No language data
- Stars
- 211
- Forks
- 35
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 1
Description
## Problem
AWS Resource Explorer service views are AWS-owned resources (empty account field in the ARN), but they are not listed in the `NotResource` element of `EnforceResourcePerimeterAWSResources`. This causes `resource-explorer-2:Search` to be denied by the SCP.
Error:
```
User: arn:aws:sts:::assumed-role// is not authorized to perform:
resource-explorer-2:Search on resource:
arn:aws:resource-explorer-2:::view/AWSServiceViewForResourceExplorer/service-view
with an explicit deny in a service control policy
```
## Proposed Fix
Add the following to the `NotResource` list in `EnforceResourcePerimeterAWSResources`:
```
"arn:aws:resource-explorer-2:*::view/*"
```
or maybe preferably this - it depends on how AWS manages Resource Explorer Service Views:
```
"arn:aws:resource-explorer-2:*::view/AWSServiceViewForResourceExplorer/*"
```
And add a corresponding entry to `service_owned_resources.md`:
| Resource type | Resource owner | Resource ARN | Description | Policy example |
|---|---|---|---|---|
| AWS Resource Explorer view | AWS Resource Explorer | `arn:aws:resource-explorer-2:*::view/*` | Resource Explorer maintains [service views](https://docs.aws.amazon.com/resource-explorer/latest/userguide/aws-service-views.html) that are AWS-owned views enabling resource search in the AWS Console. | [resource_perimeter_scp.json](service_control_policies/resource_perimeter_scp.json) |
Kiro assisted a human in this analysis
Contributor guide
Assessment
This issue has not been assessed yet.