Declarative Policies

src/config/policies/declarative-policies/ contains the declarative policies that set a service's account-level configuration across your AWS Organization. Unlike an SCP, which allows or denies API calls, a declarative policy sets the configuration itself, and AWS enforces it in the service for every account and Region the policy covers (declarative policies). The landing zone ships one, attached by default. You can use it as-is, modify its content, or add your own.

Declarative policies attach in organization-structure.ts through the same policies array as SCPs and tag policies. AWS Organizations allows at most 10 directly attached declarative policies per root, OU, or account, counted separately from other policy types.

Shipped declarative policy

The policy lives in ec2-guardrails.ts.

It sets two EC2 attributes:

The snapshot setting also makes already-public snapshots private, which Security Hub control EC2.182 checks for. AWS supports only block_new_sharing for AMIs (EC2 policy syntax), so unshare an AMI that is already public yourself.

Example

export const blockPublicEc2SharingDeclarativePolicy: OrganizationPolicy = {
  policyName: 'BlockPublicEc2Sharing',
  policyType: PolicyType.DECLARATIVE_POLICY_EC2,
  description: 'Blocks public sharing of EBS snapshots and AMIs',
  content: {
    ec2_attributes: {
      snapshot_block_public_access: { state: { '@@assign': 'block_all_sharing' } },
      image_block_public_access: { state: { '@@assign': 'block_new_sharing' } },
    },
  },
};

Adding a declarative policy

1. Create a policy file in src/config/policies/declarative-policies/ and export an OrganizationPolicy with policyType: PolicyType.DECLARATIVE_POLICY_EC2. Write content in the EC2 policy syntax.
2. Export it from src/config/policies/declarative-policies/index.ts.
3. Import it in organization-structure.ts and add it to the policies array of the root, OU, or account that should receive it.
4. Run pnpm run organization:diff to preview the change, then deploy the organization phase.

Things to know

• Member accounts can't change the setting while the policy applies. Account administrators can't modify an attribute a declarative policy manages (EC2 policy syntax).
• Detaching the policy restores the earlier setting. AWS rolls each account's attribute back to its state before the policy attached (declarative policies).
• It needs EC2 trusted access and the DECLARATIVE_POLICY_EC2 policy type. Both are on by default. Keep TrustedAccessAwsService.EC2 in Trusted Access and the type enabled in Organization Policy Types.
• VPC Block Public Access is not set. It cuts internet access for every VPC without an exclusion, so the landing zone leaves it off. Add it only after reviewing your workloads.
• EBS snapshot sharing is governed here only. The secure-defaults baseline doesn't set it; see SecureDefaultsConstruct.