AWS Filtering

We'll go through all the available access-types for AWS request filtering.

Filtering on tags

Policies and permission sets can be filtered based on their tags in AWS. To do this, use the tag access-type. The key is the tag key, and the pattern matches on the tag value.

Rule structure:

resource:
  type: integration
  service: aws
  filters:
    tag:
      effect: keep|remove|removeAll
      key: <tag key>
      pattern: <regex pattern>

Allow requesting only policies and permission sets with the tag "environment" set to "dev" :

resource:
  type: integration
  service: aws
  filters:
    tag:
      effect: keep
      key: environment
      pattern: ^dev$.

Filtering on IAM groups

To filter on IAM group requests, we can use the group access-type. There is a single available key, name, which refers to the name of the IAM group.

Rule structure:

resource:
  type: integration
  service: aws
  filters:
    group:
      effect: keep|remove|removeAll
      key: name
      pattern: <regex pattern>

Allow requesting any IAM groups except for "Admin" :

resource:
  type: integration
  service: aws
  filters:
    group:
      effect: keep
      key: name
      pattern: ^Admin$.

Filtering on permission sets

To filter on Identity Center permission set requests, we can use the permission-set access-type. There are two available keys, name (the name of the permission set) and arn (the ARN of the permission set).

' Rule structure:

resource:
  type: integration
  service: aws
  filters:
    permission-set:
      effect: keep|remove|removeAll
      key: name | arn
      pattern: <regex pattern>

Allow requesting only permission sets with "project-1" in the name:

resource:
  type: integration
  service: aws
  filters:
    permission-set:
      effect: keep
      key: name
      pattern: project-1

Filtering on policies

To filter on IAM policy requests, we can use the policy access-type. There is a single available key, arn, which refers to the ARN of the IAM policy.

Rule structure:

resource:
  type: integration
  service: aws
  filters:
    policy:
      effect: keep|remove|removeAll
      key: arn
      pattern: <regex pattern>

Allow requesting only AmazonS3 predefined policies

resource:
  type: integration
  service: aws
  filters:
    policy:
      effect: keep
      key: arn
      pattern: ^arn:aws:iam::aws:policy/AmazonS3

Filtering on resources

To filter on permission requests, we can use the resource access-type. There are 3 available keys:

• name: This is the name of the resource.

• service: This is the AWS service that the resource belongs to: for example, s3, or sagemaker. It will found in the resource ARN, after arn:aws:. For example, if the ARN is arn:aws:iam::391052057035:role/AmazonEKSNodeRole the service is iam.

• arn: This is the ARN of the resource.

Rule structure:

resource:
  type: integration
  service: aws
  filters:
    resource:
      effect: keep|remove|removeAll
      key: name|service|arn
      pattern: <regex pattern>

Allow requesting only S3 resources

resource:
  type: integration
  service: aws
  filters:
    resource:
      effect: keep
      key: service
      pattern: ^s3$

Allow requesting any resource except for IAM resources

resource:
  type: integration
  service: aws
  filters:
    resource:
      effect: remove
      key: service
      pattern: ^iam$

Allow requesting any resource containing "project-1" in the name

resource:
  type: integration
  service: aws
  filters:
    resource:
      effect: keep
      key: name
      pattern: project-1

Allow requesting only S3 buckets with names starting with "dev"

resource:
  type: integration
  service: aws
  filters:
    resource:
      effect: keep
      key: arn
      pattern: ^arn:aws:s3:::dev

Allow requesting any resource except for the S3 bucket named "top-secret-bucket"

resource:
  type: integration
  service: aws
  filters:
    resource:
      effect: keep
      key: arn
      pattern: ^arn:aws:s3:::top-secret-bucket$