쿠키 기본 설정 선택

당사는 사이트와 서비스를 제공하는 데 필요한 필수 쿠키 및 유사한 도구를 사용합니다. 고객이 사이트를 어떻게 사용하는지 파악하고 개선할 수 있도록 성능 쿠키를 사용해 익명의 통계를 수집합니다. 필수 쿠키는 비활성화할 수 없지만 '사용자 지정' 또는 ‘거부’를 클릭하여 성능 쿠키를 거부할 수 있습니다.

사용자가 동의하는 경우 AWS와 승인된 제3자도 쿠키를 사용하여 유용한 사이트 기능을 제공하고, 사용자의 기본 설정을 기억하고, 관련 광고를 비롯한 관련 콘텐츠를 표시합니다. 필수가 아닌 모든 쿠키를 수락하거나 거부하려면 ‘수락’ 또는 ‘거부’를 클릭하세요. 더 자세한 내용을 선택하려면 ‘사용자 정의’를 클릭하세요.

설정
문의하기
피드백
AWS Documentation
AWS 계정 생성
Elective controls with preventive behavior - AWS Control Tower
AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLEDAWS-GR_AUDIT_BUCKET_LOGGING_ENABLEDAWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITEDAWS-GR_AUDIT_BUCKET_RETENTION_POLICYAWS-GR_DISALLOW_CROSS_REGION_NETWORKINGAWS-GR_DISALLOW_VPC_INTERNET_ACCESSAWS-GR_DISALLOW_VPN_CONNECTIONSAWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYSAWS-GR_RESTRICT_ROOT_USERAWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATIONAWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFACloudFormation hook SCP
이 페이지는 귀하의 언어로 번역되지 않았습니다. 번역 요청

Elective controls with preventive behavior

PDF

The following elective controls have preventive behavior.

The elective controls with preventive behavior are configurable. For more information about configurable controls, see Controls with parameters.

[AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLED] Enable encryption at rest for log archive

Protect the integrity of your log archive through encryption at rest using server side encryption (SSE) with KMS customer-created master keys (CMK).

This is a preventive control with elective guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs.

AWS service: Amazon S3

Control metadata

  • Control objective: Encrypt data at rest

  • Implementation: Service control policy (SCP)

  • Control behavior: Preventive

  • Control owner: AWS Control Tower

  • Control groups: digital-sovereignty

  • Resource types: AWS::S3::Bucket

Usage considerations

  • This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: ExemptedPrincipalArns. For more information, see Configure controls with parameters.

The artifact for this control is the following service control policy (SCP). 


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GRAUDITBUCKETENCRYPTIONENABLED",
            "Effect": "Deny",
            "Action": "s3:PutEncryptionConfiguration",
            "Resource": "*",
            "Condition": {
                "ArnNotLike": {
                    "aws:PrincipalARN": [
                        {{ExemptedPrincipalArns}}
                        "arn:*:iam::*:role/AWSControlTowerExecution"
                    ]
                }
            }
        }
    ]
}

[AWS-GR_AUDIT_BUCKET_LOGGING_ENABLED] Enable access logging for log archive

Track log archive access requests using S3 bucket access logging.

This is a preventive control with elective guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs.

AWS service: Amazon S3

Control metadata

  • Control objective: Establish logging and monitoring

  • Implementation: Service control policy (SCP)

  • Control behavior: Preventive

  • Control owner: AWS Control Tower

  • Resource types: AWS::S3::Bucket

Usage considerations

  • This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: ExemptedPrincipalArns. For more information, see Configure controls with parameters.

The artifact for this control is the following service control policy (SCP). 


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GRAUDITBUCKETLOGGINGENABLED",
            "Effect": "Deny",
            "Action": "s3:PutBucketLogging",
            "Resource": "*",
            "Condition": {
                "ArnNotLike": {
                    "aws:PrincipalARN": [
                        {{ExemptedPrincipalArns}}
                        "arn:*:iam::*:role/AWSControlTowerExecution"
                    ]
                }
            }
        }
    ]
}

[AWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITED] Disallow policy changes to log archive

Protect the integrity of your log archive by ensuring no policy changes happen to the S3 bucket by any user.

This is a preventive control with elective guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs.

AWS service: Amazon S3

Control metadata

  • Control objective: Protect data integrity

  • Implementation: Service control policy (SCP)

  • Control behavior: Preventive

  • Control owner: AWS Control Tower

  • Resource types: AWS::S3::Bucket

Usage considerations

  • This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: ExemptedPrincipalArns. For more information, see Configure controls with parameters.

The artifact for this control is the following service control policy (SCP). 


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GRAUDITBUCKETPOLICYCHANGESPROHIBITED",
            "Effect": "Deny",
            "Action": "s3:PutBucketPolicy",
            "Resource": "*",
            "Condition": {
                "ArnNotLike": {
                    "aws:PrincipalARN": [
                        {{ExemptedPrincipalArns}}
                        "arn:*:iam::*:role/AWSControlTowerExecution"
                    ]
                }
            }
        }
    ]
}

[AWS-GR_AUDIT_BUCKET_RETENTION_POLICY] Set a retention policy for log archive

Limit data retention in the log archive using a retention policy that defaults to 365 days.

This is a preventive control with elective guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs.

AWS service: Amazon S3

Control metadata

  • Control objective: Improve resiliency

  • Implementation: Service control policy (SCP)

  • Control behavior: Preventive

  • Control owner: AWS Control Tower

  • Resource types: AWS::S3::Bucket

Usage considerations

  • This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: ExemptedPrincipalArns. For more information, see Configure controls with parameters.

The artifact for this control is the following service control policy (SCP). 


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GRAUDITBUCKETRETENTIONPOLICY",
            "Effect": "Deny",
            "Action": "s3:PutLifecycleConfiguration",
            "Resource": "*",
            "Condition": {
                "ArnNotLike": {
                    "aws:PrincipalARN": [
                        {{ExemptedPrincipalArns}}
                        "arn:*:iam::*:role/AWSControlTowerExecution"
                    ]
                }
            }
        }
    ]
}

[AWS-GR_DISALLOW_CROSS_REGION_NETWORKING] Disallow cross-region networking for Amazon EC2, Amazon CloudFront, and AWS Global Accelerator

Disallow cross-region networking connections from Amazon EC2, Amazon CloudFront, and AWS Global Accelerator services.

This is a preventive control with elective guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs.

AWS service: Amazon CloudFront, Amazon EC2, AWS Global Accelerator

Control metadata

  • Control objective: Limit network access

  • Implementation: Service control policy (SCP)

  • Control behavior: Preventive

  • Control owner: AWS Control Tower

  • Resource types: AWS::CloudFront::Distribution, AWS::EC2::VPCPeeringConnection, AWS::EC2::TransitGatewayPeeringAttachment, AWS::GlobalAccelerator::Accelerator, AWS::GlobalAccelerator::EndpointGroup, AWS::GlobalAccelerator::Listener

Usage considerations

  • This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: ExemptedPrincipalArns. For more information, see Configure controls with parameters.

The artifact for this control is the following service control policy (SCP). 


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GRDISALLOWCROSSREGIONNETWORKING",
            "Effect": "Deny",
            "Action": [
                "cloudfront:CreateDistribution",
                "cloudfront:UpdateDistribution",
                "ec2:AcceptTransitGatewayPeeringAttachment",
                "ec2:AcceptVpcPeeringConnection",
                "ec2:CreateTransitGatewayPeeringAttachment",
                "ec2:CreateVpcPeeringConnection",
                "globalaccelerator:Create*",
                "globalaccelerator:Update*"
            ],
            "Resource": "*"{% if ExemptedPrincipalArns %},
            "Condition": {
                "ArnNotLike": {
                    "aws:PrincipalArn": {{ExemptedPrincipalArns}}
                }
            }{% endif %}
        }
    ]
}

[AWS-GR_DISALLOW_VPC_INTERNET_ACCESS] Disallow internet access for an Amazon VPC instance managed by a customer

Disallow internet access for an Amazon Virtual Private Cloud (VPC) instance managed by a customer, rather than by an AWS service.

This is a preventive control with elective guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs.

AWS service: Amazon EC2

Control metadata

  • Control objective: Limit network access

  • Implementation: Service control policy (SCP)

  • Control behavior: Preventive

  • Control owner: AWS Control Tower

  • Control groups: digital-sovereignty

  • Resource types: AWS::EC2::InternetGateway, AWS::EC2::EgressOnlyInternetGateway, AWS::EC2::VPC, AWS::EC2::Subnet, AWS::EC2::CarrierGateway

Usage considerations

  • This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: ExemptedPrincipalArns. For more information, see Configure controls with parameters.

The artifact for this control is the following service control policy (SCP). 


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GRDISALLOWVPCINTERNETACCESS",
            "Effect": "Deny",
            "Action": [
                "ec2:AttachEgressOnlyInternetGateway",
                "ec2:AttachInternetGateway",
                "ec2:CreateCarrierGateway",
                "ec2:CreateDefaultSubnet",
                "ec2:CreateDefaultVpc",
                "ec2:CreateEgressOnlyInternetGateway",
                "ec2:CreateInternetGateway"
            ],
            "Resource": "*",
            "Condition": {
                "ArnNotLike": {
                    "aws:PrincipalARN": [
                        {{ExemptedPrincipalArns}}
                        "arn:*:iam::*:role/AWSControlTowerExecution"
                    ]
                }
            }
        }
    ]
}

[AWS-GR_DISALLOW_VPN_CONNECTIONS] Disallow Amazon Virtual Private Network (VPN) connections

Disallows Virtual Private Network (VPN) connections (Site-to-Site VPN and Client VPN) to an Amazon Virtual Private Cloud (VPC).

This is a preventive control with elective guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs.

AWS service: Amazon EC2

Control metadata

  • Control objective: Limit network access

  • Implementation: Service control policy (SCP)

  • Control behavior: Preventive

  • Control owner: AWS Control Tower

  • Resource types: AWS::EC2::VPNGateway, AWS::EC2::CustomerGateway, AWS::EC2::VPNConnection, AWS::EC2::ClientVpnEndpoint, AWS::EC2::ClientVpnTargetNetworkAssociation, AWS::EC2::ClientVpnAuthorizationRule

Usage considerations

  • This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: ExemptedPrincipalArns. For more information, see Configure controls with parameters.

The artifact for this control is the following service control policy (SCP). 


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GRDISALLOWVPNCONNECTIONS",
            "Effect": "Deny",
            "Action": [
                "ec2:AssociateClientVpnTargetNetwork",
                "ec2:AttachVPNGateway",
                "ec2:AuthorizeClientVpnIngress",
                "ec2:CreateClientVpnEndpoint",
                "ec2:CreateCustomerGateway",
                "ec2:CreateVPNGateway",
                "ec2:CreateVpnConnection",
                "ec2:ModifyClientVpnEndpoint",
                "ec2:ModifyVpnConnection"
            ],
            "Resource": "*"{% if ExemptedPrincipalArns %},
            "Condition": {
                "ArnNotLike": {
                    "aws:PrincipalArn": {{ExemptedPrincipalArns}}
                }
            }{% endif %}
        }
    ]
}

[AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS] Disallow creation of access keys for the root user

Secure your AWS accounts by disallowing creation of access keys for the root user, which will allow unrestricted access to all resources in the account. We recommend that you instead create access keys for an AWS Identity and Access Management (IAM) user for everyday interaction with your AWS account.

This is a preventive control with strongly-recommended guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs.

AWS service: AWS Identity and Access Management (IAM)

Control metadata

  • Control objective: Enforce least privilege

  • Implementation: Service control policy (SCP)

  • Control behavior: Preventive

  • Control owner: AWS Control Tower

  • Resource types: AWS::::Account, AWS::IAM::AccessKey

Usage considerations

  • This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: ExemptedPrincipalArns. For more information, see Configure controls with parameters.

The artifact for this control is the following service control policy (SCP). 


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GRRESTRICTROOTUSERACCESSKEYS",
            "Effect": "Deny",
            "Action": "iam:CreateAccessKey",
            "Resource": "*",
            "Condition": {
                "ArnLike": {
                    "aws:PrincipalArn": [
                        "arn:*:iam::*:root"
                    ]
                }{% if ExemptedPrincipalArns %},
                "ArnNotLike": {
                    "aws:PrincipalArn": {{ExemptedPrincipalArns}}
                }{% endif %}
            }
        }
    ]
}

[AWS-GR_RESTRICT_ROOT_USER] Disallow actions as a root user

Secure your AWS accounts by disallowing account access with root user credentials, which are credentials of the account owner and allow unrestricted access to all resources in the account. We recommend that you instead create AWS Identity and Access Management (IAM) users for everyday interaction with your AWS account.

This is a preventive control with strongly-recommended guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs.

AWS service: AWS Identity and Access Management (IAM)

Control metadata

  • Control objective: Enforce least privilege

  • Implementation: Service control policy (SCP)

  • Control behavior: Preventive

  • Control owner: AWS Control Tower

  • Resource types: AWS::::Account

Usage considerations

  • This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: ExemptedPrincipalArns. For more information, see Configure controls with parameters.

The artifact for this control is the following service control policy (SCP). 


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GRRESTRICTROOTUSER",
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "aws:PrincipalArn": [
                        "arn:*:iam::*:root"
                    ]
                }{% if ExemptedPrincipalArns %},
                "ArnNotLike": {
                    "aws:PrincipalArn": {{ExemptedPrincipalArns}}
                }{% endif %}
            }
        }
    ]
}

[AWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATION] Disallow cross region replication for S3 buckets

Contain the location of your S3 data to a single region by disabling any automatic, asynchronous copying of objects across buckets to other AWS Regions.

This is a preventive control with elective guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs.

AWS service: Amazon S3

Control metadata

  • Control objective: Improve resiliency

  • Implementation: Service control policy (SCP)

  • Control behavior: Preventive

  • Control owner: AWS Control Tower

  • Resource types: AWS::S3::Bucket

Usage considerations

  • This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: ExemptedPrincipalArns. For more information, see Configure controls with parameters.

The artifact for this control is the following service control policy (SCP). 


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GRRESTRICTS3CROSSREGIONREPLICATION",
            "Effect": "Deny",
            "Action": "s3:PutReplicationConfiguration",
            "Resource": "*"{% if ExemptedPrincipalArns %},
            "Condition": {
                "ArnNotLike": {
                    "aws:PrincipalArn": {{ExemptedPrincipalArns}}
                }
            }{% endif %}
        }
    ]
}

[AWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFA] Disallow delete actions on S3 buckets without MFA

Protect your S3 buckets by requiring multi-factor authentication (MFA) for delete actions. MFA adds an extra authentication code on top of a user name and password.

This is a preventive control with elective guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs.

AWS service: Amazon S3

Control metadata

  • Control objective: Protect data integrity

  • Implementation: Service control policy (SCP)

  • Control behavior: Preventive

  • Control owner: AWS Control Tower

  • Resource types: AWS::S3::Bucket

Usage considerations

  • This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: ExemptedPrincipalArns. For more information, see Configure controls with parameters.

The artifact for this control is the following service control policy (SCP). 


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GRRESTRICTS3DELETEWITHOUTMFA",
            "Effect": "Deny",
            "Action": [
                "s3:DeleteObject",
                "s3:DeleteBucket"
            ],
            "Resource": "*",
            "Condition": {
                "BoolIfExists": {
                    "aws:MultiFactorAuthPresent": [
                        "false"
                    ]
                }{% if ExemptedPrincipalArns %},
                "ArnNotLike": {
                    "aws:PrincipalArn": {{ExemptedPrincipalArns}}
                }{% endif %}
            }
        }
    ]
}

[CT.CLOUDFORMATION.PR.1] Disallow management of resource types, modules, and hooks within the AWS CloudFormation registry

This elective control disallows management of the following extension types in the AWS CloudFormation registry: resource types, modules, and hooks. For more information about AWS CloudFormation extensions, see Using the AWS CloudFormationregistry.

A typical use case for this control is a situation in which you do not wish to allow your organization to register AWS CloudFormation types. It prevents registration of types, and it prevents disabling existing AWS CloudFormation hooks.

  • Control objective: Protect configurations

  • Implementation Service control policy (SCP)

  • Control behavior: Preventive

  • Control guidance: Elective

  • Control owner: AWS Control Tower

  • Control ID: CT.CLOUDFORMATION.PR.1

  • Severity: Critical

  • AWS Service: AWS CloudFormation

  • Resource types: AWS::CloudFormation::HookDefaultVersion, AWS::CloudFormation::HookTypeConfig, AWS::CloudFormation::HookVersion, AWS::CloudFormation::ModuleDefaultVersion, AWS::CloudFormation::ModuleVersion, AWS::CloudFormation::ResourceDefaultVersion, AWS::CloudFormation::ResourceVersion

The following example shows the SCP artifact for this control.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GRDISALLOWMODIFICATIONCFNREGISTRY",
            "Effect": "Deny",
            "Action": [
                "cloudformation:RegisterType",
                "cloudformation:DeregisterType",
                "cloudformation:SetTypeConfiguration",
                "cloudformation:SetTypeDefaultVersion",
                "cloudformation:PublishType"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "ArnNotLike": {
                    "aws:PrincipalARN": "arn:aws:iam::*:role/AWSControlTowerExecution"
                }
            }
        }
    ]
}

다음 주제:

Q search for controls

도움이 필요하십니까?

프라이버시사이트 이용 약관쿠키 기본 설정
© 2025, Amazon Web Services, Inc. 또는 계열사. All rights reserved.