adding billing and budgets

aws-samples · Apr 5, 2020 · b31fbb8 · b31fbb8
1 parent 9adf0ae
commit b31fbb8
Show file tree

Hide file tree

Showing 4 changed files with 38 additions and 0 deletions.
diff --git a/docs/guardrails/billing/guardrails.md b/docs/guardrails/billing/guardrails.md
@@ -0,0 +1,9 @@
+---
+layout: default
+---
+
+## AWS Billing
+
+| Identifier    | Guardrail                                                                                                   | Rationale                                                                                                                                                                                                                                                     | Remediation                                                           | References                                                                | Policy   | IAM Actions                                                                                 |
+|:--------------|:------------------------------------------------------------------------------------------------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------------------------------------------------------------------|:--------------------------------------------------------------------------|:---------|:--------------------------------------------------------------------------------------------|
+| IAM-BILLING-1 | Check that the ability to modify or update AWS Billing options are only assumable to authorized principals. | In all AWS environments, ensure that only billing administrators and authorized principals should be able to update or modify AWS Billing options. Unauthorized modifications could affect your billing payments or account information such as email address | For unauthorized principals, either remove the associated IAM Actions | ['https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsbilling.html'] | IAM      | ['aws-portal:ModifyBilling', 'aws-portal:ModifyAccount', 'aws-portal:ModifyPaymentMethods'] |
diff --git a/docs/guardrails/budgets/guardrails.md b/docs/guardrails/budgets/guardrails.md
@@ -0,0 +1,9 @@
+---
+layout: default
+---
+
+## AWS Budgets
+
+| Identifier    | Guardrail                                                                                                   | Rationale                                                                                                                                                                                                             | Remediation                                                           | References                                                                                   | Policy   | IAM Actions              |
+|:--------------|:------------------------------------------------------------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------------------------------------------------------------------|:---------------------------------------------------------------------------------------------|:---------|:-------------------------|
+| IAM-BUDGETS-1 | Check that the ability to modify or update AWS Budgets options are only assumable to authorized principals. | In all AWS environments, ensure that only Budget administrators and authorized principals should be able to update or modify AWS Budgets options. Unauthorized modifications could affect your cost and usage budgets | For unauthorized principals, either remove the associated IAM Actions | ['https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/budgets-managing-costs.html'] | IAM      | ['budgets:ModifyBudget'] |
diff --git a/guardrails/billing/IAM-BILLING-1.json b/guardrails/billing/IAM-BILLING-1.json
@@ -0,0 +1,10 @@
+{
+  "Identifier": "IAM-BILLING-1",
+  "Guardrail": "Check that the ability to modify or update AWS Billing options are only assumable to authorized principals.",
+  "Rationale": "In all AWS environments, ensure that only billing administrators and authorized principals should be able to update or modify AWS Billing options. Unauthorized modifications could affect your billing payments or account information such as email address",
+  "Remediation": "For unauthorized principals, either remove the associated IAM Actions",
+  "References": ["https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsbilling.html"],
+  "Policy": "IAM",
+  "IAM Actions": ["aws-portal:ModifyBilling", "aws-portal:ModifyAccount", "aws-portal:ModifyPaymentMethods"],
+  "Authorized Principals": ""
+}
diff --git a/guardrails/budgets/IAM-BUDGETS-1.json b/guardrails/budgets/IAM-BUDGETS-1.json
@@ -0,0 +1,10 @@
+{
+  "Identifier": "IAM-BUDGETS-1",
+  "Guardrail": "Check that the ability to modify or update AWS Budgets options are only assumable to authorized principals.",
+  "Rationale": "In all AWS environments, ensure that only Budget administrators and authorized principals should be able to update or modify AWS Budgets options. Unauthorized modifications could affect your cost and usage budgets",
+  "Remediation": "For unauthorized principals, either remove the associated IAM Actions",
+  "References": ["https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/budgets-managing-costs.html"],
+  "Policy": "IAM",
+  "IAM Actions": ["budgets:ModifyBudget"],
+  "Authorized Principals": ""
+}