children-scp.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyContractCommitments",
      "Effect": "Deny",
      "Action": [
        "organizations:*",
        "route53domains:TransferDomain",
        "redshift:PurchaseReservedNodeOffering",
        "ec2:PurchaseReservedInstancesOffering",
        "savingsplans:*",
        "ec2:PurchaseHostReservation",
        "rds:PurchaseReservedDBInstancesOffering",
        "ec2:CreateCapacityReservation",
        "ec2:PurchaseScheduledInstances",
        "ec2:CreateReservedInstancesListing",
        "s3:PutObjectLegalHold",
        "s3:PutObjectRetention",
        "route53domains:RegisterDomain",
        "ec2:AcceptReservedInstancesExchangeQuote",
        "s3:PutBucketObjectLockConfiguration"
      ],
      "Resource": [
        "*"
      ]
    }, 
    {
      "Sid": "DenyChangesToAdminPrincipalRoleAndPolicy",
      "Effect": "Deny",
      "NotAction": [
        "iam:GetContextKeysForPrincipalPolicy",
        "iam:GetRole",
        "iam:GetRolePolicy",
        "iam:ListAttachedRolePolicies",
        "iam:ListInstanceProfilesForRole",
        "iam:ListRolePolicies",
        "iam:ListRoleTags",
        "iam:DeactivateMFADevice",
        "iam:CreateSAMLProvider",
        "iam:UpdateAccountPasswordPolicy",
        "iam:DeleteVirtualMFADevice",
        "iam:EnableMFADevice",
        "iam:CreateAccountAlias",
        "iam:DeleteAccountAlias",
        "iam:UpdateSAMLProvider",
        "iam:DeleteSAMLProvider"
      ],
      "Resource": [
        "arn:aws:iam::*:role/AdminRole",
        "arn:aws:iam::*:role/DCEPrincipal*",
        "arn:aws:iam::*:policy/DCEPrincipal*"
      ],
      "Condition": {
        "StringNotLike": {
          "aws:PrincipalARN": "arn:aws:iam::*:role/DCEAdmin"
        }
      }
    },
    {
      "Sid": "DenyUnsupportedRegions",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": [
            "us-east-1",
            "us-west-2"
          ]
        }
      }
    },
    {
      "Sid": "DenyUnsupportedServices",
      "Effect": "Deny",
      "NotAction": [
        "acm:*",
        "acm-pca:*",
        "apigateway:*",
        "application-autoscaling:*",
        "appstream:*",
        "athena:*",
        "autoscaling:*",
        "backup:*",
        "batch:*",
        "cloud9:*",
        "clouddirectory:*",
        "cloudformation:*",
        "cloudfront:*",
        "cloudhsm:*",
        "cloudsearch:*",
        "cloudtrail:*",
        "cloudwatch:*",
        "codebuild:*",
        "codecommit:*",
        "codedeploy:*",
        "codepipeline:*",
        "codestar:*",
        "cognito-identity:*",
        "cognito-idp:*",
        "comprehend:*",
        "config:*",
        "datapipeline:*",
        "dax:*",
        "devicefarm:*",
        "discovery:*",
        "dms:*",
        "ds:*",
        "dynamodb:*",
        "ec2:*",
        "ecr:*",
        "ecs:*",
        "eks:*",
        "elasticache:*",
        "elasticbeanstalk:*",
        "elasticfilesystem:*",
        "elasticloadbalancing:*",
        "elasticmapreduce:*",
        "elastictranscoder:*",
        "es:*",
        "events:*",
        "execute-api:*",
        "firehose:*",
        "fsx:*",
        "globalaccelerator:*",
        "glue:*",
        "iam:*",
        "imagebuilder:*",
        "iot:*",
        "iotanalytics:*",
        "kafka:*",
        "kinesis:*",
        "kinesisanalytics:*",
        "kinesisvideo:*",
        "kms:*",
        "lakeformation:*",
        "lambda:*",
        "lex:*",
        "lightsail:*",
        "logs:*",
        "machinelearning:*",
        "mediaconvert:*",
        "medialive:*",
        "mediapackage:*",
        "mediastore:*",
        "mediatailor:*",
        "mgh:*",
        "mobilehub:*",
        "mq:*",
        "neptune-db:*",
        "opsworks:*",
        "opsworks-cm:*",
        "rds:*",
        "redshift:*",
        "rekognition:*",
        "resource-groups:*",
        "robomaker:*",
        "route53:*",
        "s3:*",
        "sagemaker:*",
        "secretsmanager:*",
        "servicecatalog:*",
        "servicediscovery:*",
        "ses:*",
        "sns:*",
        "sqs:*",
        "ssm:*",
        "states:*",
        "storagegateway:*",
        "sts:*",
        "tag:*",
        "transfer:*",
        "waf:*",
        "wafv2:*",
        "waf-regional:*",
        "worklink:*",
        "workspaces:*",
        "aws-portal:ViewBilling",
        "aws-portal:ViewAccount",
        "ce:*",
        "cur:*",
        "arsenal:*"
      ],
      "Resource": "*"
    }
  ]
}