ACM.183 Trying out the new AWS billing actions in our SCP — Part of my series on Automating Cybersecurity Metrics. The Code. In my last post, I spent far too long messing around with deprecated AWS IAM billing actions. SCP to Allow Closing and Removing AWS Accounts — Part 2 ACM.183 Using CloudTrail to troubleshoot a Service Control Policy and the mysterious GetAccountPreferences actionmedium.com AWS updated billing options for IAM Policies

ACM.183 Using CloudTrail to troubleshoot a Service Control Policy and the mysterious GetAccountPreferences action — Part of my series on Automating Cybersecurity Metrics. The Code. In the last post I was trying to set up a service control policy architecture that prevents unauthorized removal of an account from an AWS organization, while still allowing for approved changes. SCP to Allow Closing and Removing AWS Accounts — Part 1 ACM.182 Only allow closing and removing accounts moved to an organizational unit for suspended accountsmedium.com

ACM.182 Only allow closing and removing accounts moved to an organizational unit for suspended accounts — Part of my series on Automating Cybersecurity Metrics. The Code. In the last post I showed you how I performed some troubleshooting on an SCP that wasn’t performing as expected. Root SCP Fails to Disable Root Actions — Troubleshooting SCPs 181. Also, test your policies, and monitor for inadvertent or malicious changesmedium.com

181. Also, test your policies, and monitor for inadvertent or malicious changes — Part of my series on Automating Cybersecurity Metrics. The Code. In the last post in this series we took a look at a potential structure for an AWS Organization. Now I’m going to work on implementing that. But first we have some cleanup and testing to perform. Defining AWS Accounts and Organizational Units ACM.180 Defining accounts and organizational units based on by trust boundaries and roles to protect critical assetsmedium.com

Error message for AWS CloudFormation with a Service Control Policy is *Not Helpful* (or any IAM-like policy) — I’m trying to deploy a service control policy with CloudFormation. This should be straightforward. I got the policy working without an fn::ImportValue that references a value in another stack. I cannot find any documentation saying this won’t work. This is standard CloudFormation so I presume it is OK.

I have a particular file that has a portion of the code that looks like this when I open it up: However, that is not actually the format of the file. The file was pulled from GitHub and looks like this:

The design of AWS Organizations is such that accounts and OUs end up having repetitive and redundant FullAWSAccess policies. It seems like you should be able to remove one of the redundant policies. …

If anyone out there working on AWS CloudShell happens to see this, I’d consider this a bug because it makes CloudShell pretty much unusable for copy/paste from a MAC. I’m working in a terminal window on a Mac. I highlight and copy a block of code using ctrl-c Head over…