Team-based S3 access control

Restricts S3 operations to principals tagged with specific team identifiers, implementing role-based access control for data resources.

Policy description

What this SCP does

This Service Control Policy (SCP) restricts S3 operations to principals tagged with specific team identifiers, implementing role-based access control for data resources. This ensures only approved teams can access data storage resources.

The policy denies all S3 operations unless the principal (user or role) has a tag "Team" with the value "DataTeam". This implements a team-based access control model where only members of the data team can interact with S3 resources.

Validation strategy

How to test this SCP works

To validate this SCP, we need to test access with both tagged and untagged principals.

Valid test: S3 operations performed by a role with the Team=DataTeam tag (should succeed)
Invalid test: S3 operations performed by a role without the appropriate tag (should be denied)

Testing this SCP requires more complex setup including creating roles with different tags and assuming those roles to perform S3 operations. The example code shows how to create the test roles, but fully testing the SCP would require additional steps to assume those roles from EC2 instances or through temporary credentials.

SCP policy & validation scenarios

{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyS3AccessNonDataTeam", "Effect": "Deny", "Action": "s3:*", "Resource": "*", "Condition": { "StringNotEquals": { "aws:PrincipalTag/Team": "DataTeam" } } } ] }

# Note: This policy uses principal tags which require IAM setup # First, create a role without the required tag aws iam create-role \ --role-name UntrustedRole \ --assume-role-policy-document file://trust-policy.json # Create a role with the required tag aws iam create-role \ --role-name DataTeamRole \ --assume-role-policy-document file://trust-policy.json \ --tags Key=Team,Value=DataTeam # Now you would need to assume these roles and test S3 operations # The following operations should succeed when run as DataTeamRole but fail as UntrustedRole aws s3 ls # Create a test bucket (will succeed as DataTeamRole, fail as other roles) aws s3 mb s3://test-scp-bucket # Clean up when done aws s3 rb s3://test-scp-bucket

import boto3 import json # Initialize IAM client iam_client = boto3.client('iam') # Create test roles with different tags trust_policy = { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": {"Service": "ec2.amazonaws.com"}, "Action": "sts:AssumeRole" } ] } try: # Create role without required tag iam_client.create_role( RoleName='UntrustedRole', AssumeRolePolicyDocument=json.dumps(trust_policy) ) print("Created role without DataTeam tag") # Create role with required tag iam_client.create_role( RoleName='DataTeamRole', AssumeRolePolicyDocument=json.dumps(trust_policy), Tags=[ { 'Key': 'Team', 'Value': 'DataTeam' } ] ) print("Created role with DataTeam tag") # Attach S3 permissions to both roles policy_arn = 'arn:aws:iam::aws:policy/AmazonS3FullAccess' iam_client.attach_role_policy( RoleName='UntrustedRole', PolicyArn=policy_arn ) iam_client.attach_role_policy( RoleName='DataTeamRole', PolicyArn=policy_arn ) print("Note: To fully test this SCP, you'd need to:") print("1. Create EC2 instance profiles for both roles") print("2. Launch EC2 instances with each profile") print("3. From each instance, try to perform S3 operations") print("Operations should succeed from the DataTeam instance but fail from the other") # Clean up when done iam_client.detach_role_policy( RoleName='UntrustedRole', PolicyArn=policy_arn ) iam_client.detach_role_policy( RoleName='DataTeamRole', PolicyArn=policy_arn ) iam_client.delete_role(RoleName='UntrustedRole') iam_client.delete_role(RoleName='DataTeamRole') print("Cleaned up test roles") except Exception as e: print(f"Error in test setup: {e}")