The migration readiness map

# eu-only.tf: deny every AWS region except the EU ones you choose.
# Global services (IAM, Organizations, CloudFront, Route 53, and others) run in
# us-east-1, so they are exempt. Compare not_actions with AWS's current
# region-deny example before you attach it, and try it on a test OU first.

variable "allowed_regions" {
  type    = list(string)
  default = ["eu-central-1", "eu-west-1"]
}

variable "target_id" {
  description = "The OU (or account) the policy applies to. Never the root on day one."
  type        = string
}

data "aws_iam_policy_document" "eu_only" {
  statement {
    sid       = "DenyOutsideAllowedRegions"
    effect    = "Deny"
    resources = ["*"]
    not_actions = [
      "a4b:*", "acm:*", "aws-marketplace-management:*", "aws-marketplace:*",
      "aws-portal:*", "budgets:*", "ce:*", "chime:*", "cloudfront:*", "config:*",
      "cur:*", "directconnect:*", "ec2:DescribeRegions",
      "ec2:DescribeTransitGateways", "ec2:DescribeVpnGateways", "fms:*",
      "globalaccelerator:*", "health:*", "iam:*", "importexport:*", "kms:*",
      "mobileanalytics:*", "networkmanager:*", "organizations:*", "pricing:*",
      "route53:*", "route53domains:*", "route53-recovery-cluster:*",
      "route53-recovery-control-config:*", "route53-recovery-readiness:*",
      "s3:GetAccountPublic*", "s3:ListAllMyBuckets",
      "s3:ListMultiRegionAccessPoints", "s3:PutAccountPublic*", "shield:*",
      "sts:*", "support:*", "trustedadvisor:*", "waf-regional:*", "waf:*",
      "wafv2:*", "wellarchitected:*",
    ]

    condition {
      test     = "StringNotEquals"
      variable = "aws:RequestedRegion"
      values   = var.allowed_regions
    }

    # Break-glass: the role Organizations creates in each account keeps access.
    condition {
      test     = "ArnNotLike"
      variable = "aws:PrincipalARN"
      values   = ["arn:aws:iam::*:role/OrganizationAccountAccessRole"]
    }
  }
}

resource "aws_organizations_policy" "eu_only" {
  name        = "eu-only-regions"
  description = "Deny requests outside the approved EU regions"
  type        = "SERVICE_CONTROL_POLICY"
  content     = data.aws_iam_policy_document.eu_only.minified_json
}

resource "aws_organizations_policy_attachment" "eu_only" {
  policy_id = aws_organizations_policy.eu_only.id
  target_id = var.target_id
}