AWS Service Control Policies

Audience: Cloud Security Engineers and Platform Administrators.

Purpose: Create, test, and deploy AWS Service Control Policies via Kion.

---

Overview

Service Control Policies (SCPs) are organization-level policies that define maximum permissions for member accounts. SCPs are managed through Kion using Terraform.

---

Creating an SCP

Step 1: Create Policy JSON

1. In the it-ae-svc-kion-config repo, create a branch from dev
2. Create a new .json file in /compliance/aws_scps/:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": ["<action-to-deny>"],
      "Resource": "*"
    }
  ]
}

Step 2: Create Terraform Resource

Create a new .tf file in /compliance:

resource "kion_service_control_policy" "<scp_name>" {
  name        = "<Descriptive Name>"
  description = "<Description of what the SCP does>"
  policy      = file("${path.module}/aws_scps/<filename>.json")
  
  owner_user_groups {
    id = data.kion_user_group.platform_admins.list[0].id
  }
}

Step 3: Create Cloud Rule

In tamu_cloud_rules.tf, add a new cloud rule:

resource "kion_cloud_rule" "<rule_name>" {
  name        = "<Rule Name>"
  description = "<Description>"
  
  service_control_policies {
    id = kion_service_control_policy.<scp_name>.id
  }
  
  # NOTE: Do NOT add ous {} block until ready for production
}

---

Testing an SCP

Step 1: Deploy to Dev

1. Create a PR to merge your branch into dev
2. This applies the SCP to the kion-dev environment

Step 2: Apply to Test Project

1. In Kion, navigate to the test project
2. Go to Cloud management tab → Cloud rules
3. Click the three-dot menu → Add existing cloud rule
4. Select your new cloud rule

Step 3: Verify

1. Federate into the test AWS account
2. Attempt the action the SCP should prohibit
3. Verify the action is blocked

Step 4: Check AWS Organizations

1. Navigate to AWS Organizations → Policies → Service control policies
2. Select your SCP → Targets
3. Verify the policy is attached correctly

---

Deploying to Production

Organization-Wide Deployment

1. Create a PR to merge dev into main
2. If applying to all accounts, add the ous {} block:

resource "kion_cloud_rule" "<rule_name>" {
  name = "<Rule Name>"
  
  service_control_policies {
    id = kion_service_control_policy.<scp_name>.id
  }
  
  ous {
    id = <root_ou_id>  # "TAMU" root OU
  }
}

---

Quick Reference

Stage	Branch	Environment
Development	Feature branch	Local testing
Testing	dev	kion-dev
Production	main	kion.cloud.tamu.edu