aws-samples / aws-samples/data-perimeter-policy-examples

SourceVPC for Network Perimeter

Closed
#65 1 comment 0 reactions 1 assignee Claimed by @SwaraGandhi View on GitHub
Dominant language
No language data
Stars
211
Forks
35
Avg merge
1d 5h
Merged PRs (30d)
1

Description

Hello,

A couple of months ago, you issued the below message regarding SourceVPC.
However, no sample exist with aws:SourceVpcArn for now, could you explain this choice?
https://github.com/aws-samples/data-perimeter-policy-examples/blob/main/service_control_policies/network_perimeter_sourcevpc_scp.json

------------
We are reaching out regarding IAM policies in your environment that use the aws:SourceVpc [1] condition key. VPC IDs are only unique within a Region, meaning the same VPC ID can exist in different AWS Regions. Therefore, for AWS services that support aws:SourceVpcArn [2], we recommend that you use aws:SourceVpcArn instead of aws:SourceVpc because aws:SourceVpcArn contains both the identifier of the VPC and the Region from which the request originated. For a list of services that support aws:SourceVpcArn, refer to the aws:SourceVpcArn documentation page [2].

For AWS services that do not yet support aws:SourceVpcArn, we recommend using the aws:SourceVpc condition key together with the aws:RequestedRegion [3] condition key in your policies. The use of these two keys together ensures that requests are tied to the Region that your VPC endpoint is in.

Your affected policies are listed in the 'Affected resources' tab of your AWS Health Dashboard. Please note, for S3 bucket policies you should use aws:SourceVpcArn instead of aws:SourceVpc.

------------

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.