SCPs: Protecting Your AWS Environment (and your job)

Hello everyone!

We are working on an open-source IAM-as-code solution called IAMbic, and recently added AWS Service Control Policy support (AWS guardrails, typically used for compliance) seen in the attached blog.

IAMbic represents your IAM in Git as YAML Files (called iambic templates). An example repository of templates managed by IAMbic is at https://github.com/noqdev/iambic-templates-examples. The goal is that you can download IAMbic, and go from your cloud to code in ~10 minutes without needing to write any code. Any changes you make (via clicking in the cloud console, running `terraform apply`, etc) are captured by IAMbic and updated in Git, so you have a running Git history of all IAM changes over time, and Git is an eventually consistent, reliable source of truth for permissions.

IAMbic templates are bi-directional, so when you want to start managing identities in IAMbic (like cookie-cutter engineering IAM roles or AWS SSO permission sets), You go through a GitOps workflow, get approval, and instruct IAMbic to apply the changes. We have some examples in our IAMOps Philosophy docs here: https://docs.iambic.org/reference/iamops_philosophy. If you want resources to be solely managed by IAMbic, you can instruct IAMbic to prevent drift on these resources.

You can also declaratively define temporary access or permissions in the format (Example use cases: "I want userA to have access to the Salesforce app in Okta for 12 hours" or "I want to have S3 permissions to BucketA on the engineering role on the prod AWS account until DATE").

What are your thoughts? How can we make this better?