aws-allowlister
Automatically compile an AWS Service Control Policy that ONLY allows AWS services that are compliant with your preferred compliance frameworks.
| Category | Compliance & Governance |
|---|---|
| Community Stars | 225 |
| Last Commit | 2 years ago |
| Last page update | 19 days ago |
| Pricing Details | Free and open-source under the MIT License. |
| Target Audience | AWS administrators, compliance officers, security teams, and organizations needing to manage AWS service access based on compliance frameworks. |
The aws-allowlister tool addresses the complex challenge of creating and managing AWS Service Control Policies (SCPs) that comply with various regulatory frameworks. This tool automates the process of generating SCPs, which is otherwise manual, error-prone, and dependent on tribal knowledge.
Technically, aws-allowlister leverages official AWS documentation to compile SCPs that only allow access to AWS services compliant with specified frameworks such as PCI, HIPAA, SOC, ISO, and FedRAMP. The tool uses Python and can be installed via pip or Homebrew. It generates policies based on the intersection of multiple compliance frameworks by default, but also supports custom inclusion or exclusion of specific services using --include or --exclude flags.
Operationally, this tool simplifies policy management by eliminating the need for manual spreadsheet maintenance and updates. It ensures policies are kept up-to-date automatically as new services achieve compliance. The output can be customized to include a Markdown table format for easier readability, and it also provides an option to list excluded services, which is useful for auditing and compliance checks.
Key technical details include the ability to generate policies with a single command, such as aws-allowlister generate --pci, and the flexibility to output results in various formats. However, it's important to note that the tool relies on the accuracy and timeliness of AWS's official documentation and compliance attestations, which could introduce limitations if these sources are not updated promptly. Additionally, the tool's effectiveness depends on the correct configuration and regular updates to reflect changes in compliance requirements and AWS service offerings.