AWS策略-组合语句

Question

在Root/OU上分配SCP策略是有限制的，为了节省资源，我尝试将2-3个策略语句合并到一个SCP中，但这似乎行不通。

有没有人在他们的“组织”中有这样做的例子？

使用terraform (但是json是重要的部分，而不是创建方法)

resource "aws_organizations_policy" "Allowed_EC2_AND_ES_InstanceTypes" {
    name = "Allowed_EC2_AND_ES_InstanceTypes"
    type = "SERVICE_CONTROL_POLICY" 
    description = "Policy that defines which EC2 and ES Instance Types are allowed (applied via terraform)"
    tags = {"purpose": "limit EC2-ES family types"}
    content = <<CONTENT
{
    "Version": "2012-10-17",
    "Statement1": [
        {
            "Sid": "Statement1",
            "Effect": "Deny",
            "Action": ["ec2:RunInstances"],
            "Resource": ["arn:aws:ec2:*:*:instance/*"],
            "Condition": {
                "StringNotLike": {
                    "ec2:InstanceType": [
                    "t3.*",
                    "m5.*",
                    "r5.*",
                    "c5.*",
                    "m6i.*"
                  ]
                }
            }
          }
        ],
    "Statement2": [
        {
            "Sid": "Statement2",
            "Effect": "Deny",
            "Action": [
                "es:CreateDomain",
                "es:CreateElasticsearchDomain"
                ],
            "Resource": [
                "*"
                ],
            "Condition": {
                "ForAnyValue:StringEquals": {
                "aws:PrincipalType": [
                    "t2.*",
                    "c4.*",
                    "m3.*",
                    "m4.*",
                    "r3.*",
                    "r4.*"
              ]
           }
        }
      }
   ] 
}
CONTENT
}

事先非常感谢！

Answer 1

我认为应该有one "Statement" : []。在这里面，写了多个从"Sid":开始的项目。

在aws-doc中

语句元素是策略的主要元素。这个元素是必需的。语句元素可以包含单个语句或单个语句的数组。每个单独的语句块必须用大括号{ }括起来。对于多个语句，数组必须括在方括号中。"Statement": [{...},{...},{...}]

因此，您的示例应该如下所示。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Deny",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*"
            ],
            "Condition": {
                "StringNotLike": {
                    "ec2:InstanceType": [
                        "t3.*",
                        "m5.*",
                        "r5.*",
                        "c5.*",
                        "m6i.*"
                    ]
                }
            }
        },
        {
            "Sid": "Statement2",
            "Effect": "Deny",
            "Action": [
                "es:CreateDomain",
                "es:CreateElasticsearchDomain"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:PrincipalType": [
                        "t2.*",
                        "c4.*",
                        "m3.*",
                        "m4.*",
                        "r3.*",
                        "r4.*"
                    ]
                }
            }
        }
    ]
}