Merge pull request aws-samples#38 from jplock/jp-network-vpce

[feat] add EnforceNetworkPerimeter policy for S3

Author: jplock

template.yml

@@ -209,6 +209,22 @@ Resources:
                 "aws:ResourceTag/dp:exclude:identity": "true"
               BoolIfExists:
                 "aws:PrincipalIsAWSService": "false"
+          - Sid: EnforceNetworkPerimeter
+            Effect: Deny
+            Principal: "*"
+            Action: "s3:*"
+            Resource: "*"
+            Condition:
+              StringNotEqualsIfExists:
+                "aws:VpceOrgID": !If
+                  - cHasOrganizationId
+                  - !Ref pOrganizationId
+                  - !GetAtt rOrganization.Id
+                "aws:PrincipalTag/dp:exclude:network": "true"
+                "aws:ResourceTag/dp:exclude:network": "true"
+              BoolIfExists:
+                "aws:PrincipalIsAWSService": "false"
+                "aws:ViaAWSService": "false"
           - Sid: EnforceConfusedDeputyProtection
             Effect: Deny
             Principal: "*"