# 通过Service Control Policies(SCP)限制只能使用某个区域的AWS服务

通过Service Control Policies(SCP)限制只能使用us-east-1区域的AWS服务，**避免资源开错Region造成一些安全合规问题。**

此策略使用 `Deny` 效果来拒绝访问不是针对两个批准区域（`eu-central-1` 和 `eu-west-1`）之一的操作的所有请求。

批准区域可以更换成实际使用的region，"aws:PrincipalARN"替换成允许绕过限制的角色ARN；

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyAllOutsideEU",
            "Effect": "Deny",
            "Action": [
                "*"
            ],
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "eu-central-1",
                        "eu-west-1"
                    ]
                },
                "ArnNotLike": {
                    "aws:PrincipalARN": [
                        "arn:aws:iam::*:role/Role1AllowedToBypassThisSCP",
                        "arn:aws:iam::*:role/Role2AllowedToBypassThisSCP"
                    ]
                }
            }
        }
    ]
}
```

参考资料

[根据请求的AWS 区域拒绝访问AWS](https://docs.aws.amazon.com/zh_cn/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html#example-scp-deny-region)
