Merge 9cd63ef into 1d2fe14

awslabs · Apr 25, 2023 · 4ff70ab · 4ff70ab
2 parents 1d2fe14 + 9cd63ef
commit 4ff70ab
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 0 deletions.
diff --git a/...ns/addon-base-raas/packages/base-raas-cfn-templates/src/templates/onboard-account.cfn.yml b/...ns/addon-base-raas/packages/base-raas-cfn-templates/src/templates/onboard-account.cfn.yml
@@ -1227,3 +1227,8 @@ Outputs:
     Description: Route53 hosted zone
     Condition: isAppStreamAndCustomDomain
     Value: !Ref Route53HostedZone
+
+  S3VpcEndpoint:
+    Description: S3 interface endpoint
+    Condition: isAppStream
+    Value: !Ref S3Endpoint
diff --git a/...packages/base-raas-cfn-templates/src/templates/service-catalog/ec2-linux-instance.cfn.yml b/...packages/base-raas-cfn-templates/src/templates/service-catalog/ec2-linux-instance.cfn.yml
@@ -79,6 +79,18 @@ Resources:
             Action:
               - 'sts:AssumeRole'
             Resource: 'arn:aws:iam::*:role/swb-*'
+          - Effect: Deny
+            Action: '*'
+            Resource: '*'
+            Condition:
+              StringNotEquals:
+                aws:Ec2InstanceSourceVPC: "${aws:SourceVpc}"
+                aws:ec2InstanceSourcePrivateIPv4: "${aws:VpcSourceIp}"
+              BoolIfExists:
+                aws:ViaAWSService: "false"
+              'Null':
+                aws:ec2InstanceSourceVPC: "false"
+
   IAMRole:
     Type: 'AWS::IAM::Role'
     Properties:

diff --git a/...ckages/base-raas-cfn-templates/src/templates/service-catalog/ec2-windows-instance.cfn.yml b/...ckages/base-raas-cfn-templates/src/templates/service-catalog/ec2-windows-instance.cfn.yml
@@ -101,6 +101,17 @@ Resources:
             Action:
               - 'sts:AssumeRole'
             Resource: 'arn:aws:iam::*:role/swb-*'
+          - Effect: Deny
+            Action: '*'
+            Resource: '*'
+            Condition:
+              StringNotEquals:
+                aws:Ec2InstanceSourceVPC: "${aws:SourceVpc}"
+                aws:ec2InstanceSourcePrivateIPv4: "${aws:VpcSourceIp}"
+              BoolIfExists:
+                aws:ViaAWSService: "false"
+              'Null':
+                aws:ec2InstanceSourceVPC: "false"
   IAMRole:
     Type: 'AWS::IAM::Role'
     Properties: