SCP to create security groups in member AWS account

Question

I'm trying to create a SCP to restrict member account users to create/modify security group(s) that have inbound rule for SSH/RDP with Source set as 0.0.0.0 or ::/0.

Basically, I want users to SSH into EC2 instances only using bastion hosts and not any other machines.

I'm not sure if what I'm trying to achieve is possible at all but it seems like it should be possible. So far, I've managed to create below policy but stuck at Condition. I've searched AWS docs and policy generator to find fields like source but only found aws:SourceIP which is the actual IP address of TCP connection and not the source in security group inbound rule.

Any help is much appreciated.

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "Require_Restricted_SSH_RDP_Inboud_Rule_SG",
        "Effect": "Deny",
        "Action": "ec2:AuthorizeSecurityGroupIngress",
        "Resource": [
          "arn:aws:ec2:*:*:security-group/*",
          "arn:awd:ec2:*:*:security-group-rule/*"
        ],
        "Condition": {
          "??": {
            "??": "??"
          }
        }
      }
    ]
  }

Answer 1

The short answer is that you can't do this with an SCP. SCP is a preventative control, and it's great for most use-cases, and utilizes IAM to execute.

If you look at the IAM documentation here, you can see that the ec2:AuthorizeSecurityGroupIngress action doesn't have any conditions that would allow you to specify the ip addresses in the inbound/outbound rules.

Hence SCP can't be used to achieve limiting the CIDR ranges of your security group rules.

You can however, you something like firewall manager to address this, and this is particularly useful if you are in a Organization account. This post has more info.