IAM create policy allowing only one region but all global services necessary

Question

I want to limit the usage of AWS account to a single region but allowing the global services, but the below simple statement and not enough for my purpose:

{

    "Sid": "DisableRegions",

    "Effect": "Deny",

    "Action": "*",

    "Resource": "*",

    "Condition": {

        "StringNotEquals": {

            "aws:RequestedRegion": [

                "eu-central-1"

            ]

        }

    }

}

Also, I would have an S3 bucket in this region.

Any help!

Answer 1

You can refer to the below sample code:

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Sid": "AdministratorAccessForRegionFrankfurt",

            "Effect": "Allow",

            "Action": "*",

            "Resource": "*",

            "Condition": {

                "StringEquals": {

                    "aws:RequestedRegion": [

                        "eu-central-1"

                    ]

                }

            }

        },

        {

            "Sid": "AllowGlobalServices",

            "Effect": "Allow",

            "Action": [

                "aws-portal:*",

                "awsbillingconsole:*",

                "iam:*",

                "sts:*",

                "health:*",

                "support:*",

                "budgets:*",

                "cloudfront:*",

                "organizations:*",

                "trustedadvisor:*",

                "shield:*",

                "waf:*",

                "waf-regional:*",

                "route53:*",

                "route53domains:*",

                "tag:*",

                "resource-groups:*",

                "s3:Get*",

                "s3:List*",

                "s3:Head*",

                "glacier:List*",

                "glacier:Describe*",

                "glacier:Get*"

            ],

            "Resource": "*"

        },

        {

            "Sid": "AllowACMInUSEastAsWell",

            "Effect": "Allow",

            "Action": "acm:*",

            "Resource": "*",

            "Condition": {

                "StringEquals": {

                    "aws:RequestedRegion": [

                        "us-east-1"

                    ]

                }

            }

        }

    ]

}

Hope this works.

Do Check out the AWS Certification Course offered by Intellipaat.