aws-samples / aws-iam-permissions-guardrails

AWS IAM Permissions Guardrails https://aws-samples.github.io/aws-iam-permissions-guardrails/
https://aws-samples.github.io/aws-iam-permissions-guardrails/
Apache License 2.0
122 stars 42 forks source link

SCP-BILLING-1 uses deprecated aws-portal actions #60

Open BenjaminMorrisInvicro opened 10 months ago

BenjaminMorrisInvicro commented 10 months ago

Describe the bug

SCP-BILLING-1 uses deprecated aws-portal actions like aws-portal:ModifyBilling . This needs to be changed to the fine-grained controls post-migration. These are the new actions that are encompassed by the current SCP (there are a lot, so it may make more sense to just select the most critical ones):

[
          "account:CloseAccount",
          "account:DeleteAlternateContact",
          "account:GetAccountInformation",
          "account:PutAlternateContact",
          "account:PutChallengeQuestions",
          "account:PutContactInformation",
          "billing:PutContractInformation",
          "billing:RedeemCredits",
          "billing:UpdateBillingPreferences",
          "billing:UpdateIAMAccessPreference",
          "ce:CreateAnomalyMonitor",
          "ce:CreateAnomalySubscription",
          "ce:CreateNotificationSubscription",
          "ce:CreateReport",
          "ce:DeleteAnomalyMonitor",
          "ce:DeleteAnomalySubscription",
          "ce:DeleteNotificationSubscription",
          "ce:DeleteReport",
          "ce:ProvideAnomalyFeedback",
          "ce:StartSavingsPlansPurchaseRecommendationGeneration",
          "ce:UpdateAnomalyMonitor",
          "ce:UpdateAnomalySubscription",
          "ce:UpdateCostAllocationTagsStatus",
          "ce:UpdateNotificationSubscription",
          "ce:UpdatePreferences",
          "cur:PutClassicReportPreferences",
          "freetier:PutFreeTierAlertPreference",
          "invoicing:PutInvoiceEmailDeliveryPreferences",
          "payments:CreatePaymentInstrument",
          "payments:DeletePaymentInstrument",
          "payments:MakePayment",
          "payments:UpdatePaymentPreferences",
          "tax:BatchPutTaxRegistration",
          "tax:DeleteTaxRegistration",
          "tax:PutTaxInheritance"
        ]

Expected behavior

Use supported version of actions.