Hey, everyone.
And welcome back.
Now, in the earlier video, we were discussing about the basics of SIP strategies and how by default,
using the full Access ACP, the denialist strategy is taken into effect.
So in today's video, we'll go ahead and we'll look into how we can switch from a denial list based
strategy to a allow list based strategy.
Now, at this stage, one important part that we also discussed is that every route to you and account
must have at least one sap attached.
And if you want to switch, then you will have to replace the default full access policy with your custom
policy before you can remove it.
So let's go ahead and quickly try it out.
Now, at this stage, when we discuss about the service control policies, we have the default full
access policy that is available.
And if you look into the target, there are three target.
One is the root by itself.
You have the sandbox account and you have the management account.
So we want to replace this with a allow list policy.
So let's go ahead and create a new policy in the policy name.
Let's just call it as allow list policy.
And in the policy statement I'll add a statement which allows action on EC two star and cloud.
What?
I'll also be adding this policy after this video so that you can reference to it once.
Then you can go ahead and create the policy.
Great.
So the next step is you go ahead and associate this policy now.
Before we do that, let's quickly look into.
So here we are not exploring the management account.
We'll be using the sandbox account for overall testing.
Now, if you look into the sandbox account, you have two applied policies here.
One is the full access that is attached directly and second one is the full access that is inherited
from root.
All right.
So we'll keep the structures very similar.
So the allow list policy, let's go ahead and attach it at a sandbox account level.
And let's also attach it at a root level.
All right.
So if you have to verify, if you look into the sandbox account policies, this time, you should see
for policies.
So now you will be able to remove the full access based policy.
So let's go ahead and try it out.
So our full access in the targets, let's remove the sandbox account here.
All right.
And just to verify, in the sandbox account, you still have three policy.
The full access is still been inherited from root.
So you have to ensure that you remove that as well.
So let's also detach it at the root level.
And once this is done just re verify to see only allow list policy available.
So currently I'm logged in with the root user in the sandbox account and let's verify if we are able
to open up these services and perform operations.
So we'll take up some random service, for example, ideas.
Let's try creating the database.
And here you see, you got an error stating that there is a delay in a service control policy.
Similarly, let's try one more.
Let's try the sense.
Again, in a sense, you're getting the error.
Let's open up cloud watch, because cloud watch permission is very present.
And as expected, this is not really showing any errors.
You can go ahead and create cloud, watch dashboards, etc..
All right.
So I hope with this you understood on how you can switch from deny to allow list.
Now, again, if you want to switch back to the deny list, all you can do is you can disable the service
control policies.
Let's quickly do that.
And when you enable the service control policy one more time.
Although you will be able to see both of the policies, but this full access will take into effect.
So if you have to look into the targets, you'll see all of the targets are now associated.
And let me also quickly show you so in sandbox account, if you look into the policies, you have full
access in place.
So it is quite easy to switch back to the deny list strategy based approach.
So that's the high level overview and with this will conclude today's video.