SCP Syntax

For example, a user makes a request to service A. Service A then makes a request to service B on behalf of the user, and service B makes a request to service C on behalf of the user. The request received by service A does not contain the g:CalledVia condition key because the requesting principal is a user. In the request received by service B, g:CalledVia contains the service principal of service A because the request is made by service A on behalf of the user. In the request received by service C, the g:CalledVia contains the service principals of service A and service B, and the sequence is the same as that of the forwarding access request chain. In this case, g:CalledViaFirst is the service principal of service A, and g:CalledViaLast is the service principal of service B. The g:CalledViaFirst and g:CalledViaLast condition keys can be used to specify the first and last services that are called in the forwarding access chain.

Figure 2 g:CalledVia application scenario

When the user makes a request to a cloud service through the management console, CalledVia contains service.console.

For example, the following policy prevents the requests initiated on the management console from calling the RAM API for querying resource shares.

{
	"Version": "5.0",
	"Statement": [{
		"Effect": "Deny",
		"Action": [
			"ram:resourceShares:search"
		],
		"Resource": [
			"*"
		],
		"Condition": {
			"ForAnyValue:StringEquals": {
				"g:CalledVia": "service.console"
			}
		}
	}]
}

For example, the following policy prevents the invocation of cloud service APIs from March 1, 2023 to March 30, 2023.

{ 
     "Version": "5.0", 
     "Statement": [ 
         { 
             "Effect": "Deny", 
             "Action": ["ram:resourceShares:search"], 
             "Resource": ["*"], 
             "Condition": { 
                 "DateGreaterThan": {"g:CurrentTime": "2023-03-01T00:00:00Z"}, 
                 "DateLessThan": {"g:CurrentTime": "2023-03-30T23:59:59Z"} 
             } 
         } 
     ] 
 }

This condition key is used in authentication. For example, the following policy prevents users from querying VPC permissions by enterprise project, and only denies access with enterprise_project_id set to xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx in the request for calling the GET /v1/{project_id}/vpcs API.

{
	"Version": "5.0",
	"Statement": [{
		"Effect": "Deny",
		"Action": [
			"vpc:vpcs:list"
		],
		"Resource": [
			"*"
		],
		"Condition": {
			"StringEquals": {
				"g:EnterpriseProjectId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
			}
		}
	}]
}

The g:EnterpriseProjectId condition key is not a filtering condition. This means resources in the enterprise project specified by this condition key will not be filtered out. In the example for calling the GET /v1/{project_id}/vpcs API, when enterprise_project_id is all_granted_eps, the VPCs associated with all enterprise projects of the user are queried. If this policy has been configured for the user, the VPCs associated with the enterprise project specified by g:EnterpriseProjectId in the policy will not be queried.

This condition key is present only when a request is sent using STS Security Token. If a request is sent using permanent credentials, this condition key is not present.

For example, the following identity policy only allows API calling by principals authenticated using multi-factor authentication (MFA). The IfExists operator is used to cover scenarios where the g:MFAPresent condition key is not present when requests are made using permanent credentials.

{
	"Version": "5.0",
	"Statement": [{
		"Effect": "Deny",
		"Action": [
			"*"
		],
		"Resource": [
			"*"
		],
		"Condition": {
			"BoolIfExists": {
				"g:MFAPresent": "false"
			}
		}
	}]
}

For example, the following SCP prevents the user yyy from creating resource shares.

{
	"Version": "5.0",
	"Statement": [{
		"Effect": "Deny",
		"Action": [
			"ram:resourceShares:create"
		],
		"Condition": {
			"StringEquals": {
				"g:PrincipalUrn": "iam::xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:user:yyy"
			}
		}
	}]
}

For example, the following policy prevents the accounts in organization o-xxxxxxxxxxx from calling the API for searching resource shares in RAM.

{ 
     "Version": "5.0", 
     "Statement": [ 
         { 
             "Effect": "Deny", 
             "Action": ["ram:resourceShares:search"], 
             "Resource": ["*"], 
             "Condition": { 
                 "StringEquals": {  
                 "g:PrincipalOrgID": "o-xxxxxxxxxxx" 

                 } 
             } 
         } 
     ] 
 }

For example, the condition key value xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx in the following identity policy matches the management account ID in the request.

{
	"Condition": {
		"StringEquals": {
			"g:PrincipalOrgManagementAccountId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
		}
	}
}

For example, the condition key value ou-qqq in the following identity policy matches the organizational units (OUs) that the requesting principal belongs to in the request.

{
	"Condition": {
		"StringMatch": {
			"g:PrincipalOrgPath": "o-xxx/r-yyy/ou-zzz/ou-qqq/*"
		}
	}
}

For example, the condition key value ou-qqq in the following identity policy matches any child OUs that the requesting principal belongs to in the request.

{
	"Condition": {
		"StringMatch": {
			"g:PrincipalOrgPath": "o-xxx/r-yyy/ou-zzz/ou-qqq/ou-*"
		}
	}
}

For example, the condition key value service.RAM in the following policy matches the principal that is making the request.

{
    "Condition": {
        "StringEquals": {
            "g:PrincipalServiceName": "service.RAM"
        }
    }
}

For example, the following policy prevents IAM users tagged with {"department": "hr"} from accessing IAM APIs.

{
	"Version": "5.0",
	"Statement": [{
		"Effect": "Deny",
		"Action": [
			"iam:*"
		],
		"Resource": [
			"*"
		],
		"Condition": {
			"StringEquals": {
				"g:PrincipalTag/department": "hr"
			}
		}
	}]
}

For example, the following policy prevents users from creating resource shares tagged with {"team": "engineering"}.

{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": ["ram:resourceShares:create"],
            "Resource": ["*"],
            "Condition": {
                "StringEquals": {
                    "g:RequestTag/team": "engineering"
                }
            }
        }
    ]
}

For example, the following identity policy prevents users from using KMS keys of other than the specified users to decrypt data.

{
	"Version": "5.0",
	"Statement": [{
		"Effect": "Deny",
		"Action": [
			"kms:cmk:decryptData"
		],
		"Resource": [
			"*"
		],
		"Condition": {
			"StringNotEquals": {
				"g:ResourceAccount": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
			}
		}
	}]
}

For example, the following identity policy prevents users from using KMS keys of other than the specified organizations to decrypt data.

{
	"Version": "5.0",
	"Statement": [{
		"Effect": "Deny",
		"Action": [
			"kms:cmk:decryptData"
		],
		"Resource": [
			"*"
		],
		"Condition": {
			"StringNotEquals": {
				"g:ResourceOrgId": "o-xxxxxxxx"
			}
		}
	}]
}

For example, the following policy prevents users from using KMS keys of the accounts in the ou-qqq OU to decrypt data.

{
	"Version": "5.0",
	"Statement": [{
		"Effect": "Deny",
		"Action": [
			"kms:cmk:decryptData"
		],
		"Resource": [
			"*"
		],
		"Condition": {
			"StringMatch": {
				"g:ResourceOrgPath": "o-xxx/r-yyy/ou-zzz/ou-qqq/*"
			}
		}
	}]
}

For example, the following policy prevents users from using KMS keys of the accounts in the child OUs under the ou-qqq OU to decrypt data.

{
	"Version": "5.0",
	"Statement": [{
		"Effect": "Deny",
		"Action": [
			"kms:cmk:decryptData"
		],
		"Resource": [
			"*"
		],
		"Condition": {
			"StringMatch": {
				"g:ResourceOrgPath": "o-xxx/r-yyy/ou-zzz/ou-qqq/ou-*"
			}
		}
	}]
}

For example, the following policy prevents users from modifying resource shares tagged with {"team": "engineering"}.

{
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "ram:resourceShares:delete",
        "ram:resourceShares:update"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringEquals": {
          "g:ResourceTag/team": "engineering"
        }
      }
    }
  ]
}

For example, service A is used to record activities. It helps a user (account B) to dump activity logs triggered by a device (account C) to a specified OBS bucket. To enable service A to write data into the bucket, the administrator of account B creates an agency or trust agency named X for service A to manage OBS buckets under account B. After account B or account C accesses service A and triggers a request, service A obtains the temporary identity credentials of the specified agency or trust agency X and writes data to the bucket.

Figure 3 Confused deputy

The agency or trust agency name X is not confidential. If an attacker (account D) obtains the agency name and triggers service A in the same way, the activity records of the attacker would be incorrectly recorded in the OBS bucket. The attacker uses service A's agency to indirectly modify the OBS bucket of account B. This is called the confused deputy.

The g:SourceAccount condition key is used to control the account of the resource making a service-to-service request. The following policy only allows service A to switch to the assumed-agency session for account xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx or yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.

{
	"Version": "5.0",
	"Statement": [{
		"Principal": {
			"Service": [
				"Service.A"
			]
		},
		"Action": [
			"sts:agencies:assume"
		],
		"Condition": {
			"StringEquals": {
				"g:sourceAccount": [
					"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
					"yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"
				]
			}
		}
	}]
}

Similar to g:SourceAccount, this condition key is also used to solve the confused deputy issue. Assume that user devices (xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx) are defined as watches and bracelets. The g:SourceUrn condition key is used to control the URN of the resource making a service-to-service request. The following policy only allows service A to switch to the corresponding assumed-agency session for the watch or bracelet that meets the conditions.

{
	"Version": "5.0",
	"Statement": [{
		"Principal": {
			"Service": [
				"Service.A"
			]
		},
		"Action": [
			"sts:agencies:assume"
		],
		"Condition": {
			"StringEquals": {
				"g:sourceUrn": [
					"alarm:*:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:watch:*",
					"alarm:*:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:bracelet:*"
				]
			}
		}
	}]
}

For example, the following policy prevents principals whose source_identity is yyyyy from switching the agency.

{
	"Version": "5.0",
	"Statement": [{
		"Effect": "Deny",
		"Principal": {
			"IAM": [
				"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
			]
		},
		"Action": [
			"sts:agencies:assume"
		],
		"Condition": {
			"StringEquals": {
				"g:SourceIdentity": "yyyyy"
			}
		}
	}]
}

For example, the following policy denies the programmatic or console access to KMS from source IP addresses within the xxx.xx.xx.0/24 range.

The source IP address must be a public IP address. Do not include a private IP address in the condition key.

{
	"Version": "5.0",
	"Statement": [{
		"Effect": "Deny",
		"Action": [
			"kms:cmk:decryptData"
		],
		"Resource": [
			"*"
		],
		"Condition": {
			"IpAddress": {
				"g:SourceIp": "xxx.xx.xx.0/24"
			}
		}
	}]
}

The following condition keys in the initial request context will not be passed in subsequent requests forwarded by the service on behalf of the principal: g:SourceIp, g:SourceVpce, g:SourceVpc, and g:VpcSourceIp. As a result, when these condition keys are used to control access permissions, requests forwarded by the cloud service on behalf of the principal may be denied. In practice, you are advised to use g:CalledVia to forward access requests.

There is an exception: The public network access initiated by the principal from the console can be regarded as a programmatic access of the principal from the public network, so the request forwarded by the console on behalf of the principal contains the initial g:SourceIp.

For example, the following policy denies the programmatic or console access to KMS from source IP addresses beyond xxx.xx.xx.0/24. In addition, the policy allows cloud services to forward access requests on behalf of the principal.

{
	"Version": "5.0",
	"Statement": [{
			"Effect": "Deny",
			"Action": [
				"kms:cmk:decryptData"
			],
			"Resource": [
				"*"
			],
			"Condition": {
				"NotIpAddress": {
					"g:SourceIp": "xxx.xx.xx.0/24"
				},
				"Bool": {
					"g:ViaService": "false"
				}
			}
		},
		{
			"Effect": "Deny",
			"Action": [
				"kms:cmk:decryptData"
			],
			"Resource": [
				"*"
			],
			"Condition": {
				"NotIpAddress": {
					"g:SourceIp": "xxx.xx.xx.0/24"
				},
				"StringEqualsIfExists": {
					"g:CalledViaFirst": "service.console",
					"g:CalledViaLast": "service.console"
				}
			}
		}
	]
}

For example, the following policy denies access to KMS from a VPC endpoint other than xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. In addition, the policy allows cloud services to forward access requests on behalf of the principal.

{
	"Version": "5.0",
	"Statement": [{
		"Effect": "Deny",
		"Action": [
			"kms:cmk:decryptData"
		],
		"Resource": [
			"*"
		],
		"Condition": {
			"StringNotEquals": {
				"g:SourceVpce": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
			},
			"Bool": {
				"g:ViaService": "false"
			}
		}
	}]
}