Posted On: Dec 11, 2023
Today, Amazon Identity and Access Management (IAM) launched two new global condition keys for IAM policies that enable you to scalably allow Amazon Web Service services to access your resources only on your behalf. With this new IAM capability, you can simplify management of your resource-based policies to require that Amazon Web Service services access your resources only when the request originates from your organization or organizational unit (OU) in Amazon Organizations.
The new capability includes condition keys for the IAM policy language called aws:SourceOrgID and aws:SourceOrgPaths. These keys extend the capability of the existing aws:SourceAccount and aws:SourceArn condition keys to reference your organization or OU. The new keys are supported by a variety of services and actions, so you can apply similar controls across different use cases. For example, Amazon CloudTrail records account activities and logs these events to an Amazon Simple Storage Service (S3) bucket. Now, you can use the aws:SourceOrgID condition key and set the value to your organization ID in the condition element of your S3 bucket policy. This ensures that CloudTrail can only write logs on behalf of accounts within your organization to your S3 bucket, preventing CloudTrail logs outside your organization from writing to your S3 bucket.
For more information about the new condition keys, see our blog post “Use scalable controls for Amazon Web Service services accessing your resources" and the IAM documentation.