Deny Access Analyzer operations

Restricts access to AWS IAM Access Analyzer operations, only allowing access from security roles.

Policy description

What this SCP does

This Service Control Policy (SCP) restricts access to AWS IAM Access Analyzer operations, only allowing access from security roles. This ensures that security analysis capabilities are only accessible to designated security teams.

This policy is valuable for organizations that want to centralize security analysis functions and prevent unauthorized usage of Access Analyzer.

Validation strategy

How to test this SCP works

To validate this SCP, attempt to create or use Access Analyzer capabilities. The SCP will deny these operations unless the request comes from an IAM role whose name starts with 'SecurityOps'.

Invalid test: Create a new Access Analyzer (should be denied unless from SecurityOps role)
Invalid test: List existing analyzers (should be denied unless from SecurityOps role)

We expect all Access Analyzer operations to be denied with AccessDenied errors when attempted from any role that doesn't start with 'SecurityOps'.

SCP policy & validation scenarios

{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAccessAnalyzerOperations", "Effect": "Deny", "Action": "access-analyzer:*", "Resource": "*", "Condition": { "StringNotLike": { "aws:PrincipalArn": "arn:aws:iam::*:role/SecurityOps*" } } } ] }

# Try to create an Access Analyzer (this should be denied if the SCP is working) aws accessanalyzer create-analyzer \ --analyzer-name test-scp-analyzer \ --type ACCOUNT # Try to list existing analyzers (this should be denied if the SCP is working) aws accessanalyzer list-analyzers

import boto3 # Initialize Access Analyzer client analyzer_client = boto3.client('accessanalyzer') # Try to create an analyzer (this should be denied if the SCP is working) try: response = analyzer_client.create_analyzer( analyzerName='test-scp-analyzer', type='ACCOUNT' ) print("WARNING: Analyzer creation succeeded, which means the SCP is NOT restricting as expected") print(f"Analyzer ARN: {response['arn']}") except Exception as e: print(f"Expected error if SCP is working: {e}") # Try to list existing analyzers (this should be denied if the SCP is working) try: response = analyzer_client.list_analyzers() print("WARNING: Listing analyzers succeeded, which means the SCP is NOT restricting as expected") except Exception as e: print(f"Expected error if SCP is working: {e}")

Additional allow test

How to test allowed operations from a SecurityOps role

To confirm that the SCP allows Access Analyzer operations for the intended security role, follow these steps:

Create a SecurityOps IAM role using the following CloudFormation template. This role can be assumed by a trusted role you specify:
Assume the SecurityOps role and run the same Access Analyzer CLI commands. These operations should now succeed:

If these commands succeed when run from the SecurityOps role, the SCP is correctly allowing access for authorized security roles.