{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyPutImage",
"Effect": "Deny",
"Principal": "*",
"Action": "ecr:PutImage",
"Condition": {
"StringNotEquals": {
"aws:PrincipalArn": "arn:aws:iam::662322955137:role/service-role/pyei-challenge-codebuild-service-role"
}
}
}
]
}
app config
rule prevent_inbound_Ipv4_access_to_any_ip when this.configuration.ipPermissions[*].ipv4Ranges !empty {
this.configuration.ipPermissions[*].ipv4Ranges[*].cidrIp != "0.0.0.0/0" <<
result: NON_COMPLIANT
message: IPv4 Source address cannot be 0.0.0.0/0
>>
}
rule prevent_inbound_Ipv6_access_to_any_ip when this.configuration.ipPermissions[*].ipv6Ranges !empty {
this.configuration.ipPermissions[*].ipv6Ranges[*].cidrIpv6 != "::/0" <<
result: NON_COMPLIANT
message: IPv6 Source address cannot be ::/0
>>
}