aws-samples / aws-samples/data-perimeter-policy-examples
SourceVPC for Network Perimeter
- Dominant language
- No language data
- Stars
- 211
- Forks
- 35
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 1
Description
Hello,
A couple of months ago, you issued the below message regarding SourceVPC.
However, no sample exist with aws:SourceVpcArn for now, could you explain this choice?
https://github.com/aws-samples/data-perimeter-policy-examples/blob/main/service_control_policies/network_perimeter_sourcevpc_scp.json
------------
We are reaching out regarding IAM policies in your environment that use the aws:SourceVpc [1] condition key. VPC IDs are only unique within a Region, meaning the same VPC ID can exist in different AWS Regions. Therefore, for AWS services that support aws:SourceVpcArn [2], we recommend that you use aws:SourceVpcArn instead of aws:SourceVpc because aws:SourceVpcArn contains both the identifier of the VPC and the Region from which the request originated. For a list of services that support aws:SourceVpcArn, refer to the aws:SourceVpcArn documentation page [2].
For AWS services that do not yet support aws:SourceVpcArn, we recommend using the aws:SourceVpc condition key together with the aws:RequestedRegion [3] condition key in your policies. The use of these two keys together ensures that requests are tied to the Region that your VPC endpoint is in.
Your affected policies are listed in the 'Affected resources' tab of your AWS Health Dashboard. Please note, for S3 bucket policies you should use aws:SourceVpcArn instead of aws:SourceVpc.
------------
Contributor guide
Assessment
This issue has not been assessed yet.