Scppatches (#1155)

* Incorporated SCP changes from closed PRs

* Added SCP changes re private marketplace

Author: archikierstead

reference-artifacts/SCPs/ASEA-Guardrails-Part0-CoreOUs.json

@@ -78,10 +78,13 @@
         "kms:PutKeyPolicy",
         "kms:ScheduleKeyDeletion"
       ],
-      "Resource": "arn:aws:kms:::alias/${ACCELERATOR_PREFIX_ND}*",
+      "Resource": "*",
       "Condition": {
         "ArnNotLike": {
           "aws:PrincipalARN": ["arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"]
+        },
+        "ForAnyValue:StringLike": {
+          "kms:ResourceAliases": "alias/${ACCELERATOR_PREFIX_ND}*"
         }
       }
     },

reference-artifacts/SCPs/ASEA-Guardrails-Part0-WkldOUs.json

@@ -78,13 +78,17 @@
         "kms:PutKeyPolicy",
         "kms:ScheduleKeyDeletion"
       ],
-      "Resource": "arn:aws:kms:::alias/${ACCELERATOR_PREFIX_ND}*",
+      "Resource": "*",
       "Condition": {
         "ArnNotLike": {
           "aws:PrincipalARN": ["arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"]
+        },
+        "ForAnyValue:StringLike": {
+          "kms:ResourceAliases": "alias/${ACCELERATOR_PREFIX_ND}*"
         }
       }
     },
+
     {
       "Sid": "IAM",
       "Effect": "Deny",

reference-artifacts/SCPs/ASEA-Guardrails-Sandbox.json

@@ -9,7 +9,8 @@
         "aws-marketplace:AssociateProductsWithPrivate*",
         "aws-marketplace:DescribePrivate*",
         "aws-marketplace:DisassociateProducts*",
-        "aws-marketplace:ListPrivate*"
+        "aws-marketplace:ListPrivate*",
+        "aws-marketplace:StartChangeSet"
       ],
       "Resource": "*"
     },

reference-artifacts/SCPs/ASEA-Guardrails-Sensitive.json

@@ -9,7 +9,8 @@
         "aws-marketplace:AssociateProductsWithPrivate*",
         "aws-marketplace:DescribePrivate*",
         "aws-marketplace:DisassociateProducts*",
-        "aws-marketplace:ListPrivate*"
+        "aws-marketplace:ListPrivate*",
+        "aws-marketplace:StartChangeSet"
       ],
       "Resource": "*"
     },
@@ -257,6 +258,7 @@
         "s3:GetMultiR*",
         "s3:ListMultiR*",
         "s3:PutMultiR*",
+        "sso:DescribeRegisteredRegions",
         "sns:Publish",
         "tag:GetResources"
       ],

reference-artifacts/SCPs/ASEA-Guardrails-Unclass.json

@@ -9,7 +9,8 @@
         "aws-marketplace:AssociateProductsWithPrivate*",
         "aws-marketplace:DescribePrivate*",
         "aws-marketplace:DisassociateProducts*",
-        "aws-marketplace:ListPrivate*"
+        "aws-marketplace:ListPrivate*",
+        "aws-marketplace:StartChangeSet"
       ],
       "Resource": "*"
     },