aws-control-tower-customizations
aws-control-tower-customizations copied to clipboard
Auto minify SCPs
Is your feature request related to a problem? Please describe.
SCPs that are valid from the AWS console cannot be applied via the API. This seems to be because the AWS console automatically minifies the JSON policy whereas the API applies it as-is. SCPs are limited to 5120 bytes, but you can apply much larger SCPs from the console due to the automatic minification.
Describe the feature you'd like
I would be very helpful if this framework could automatically minify the SCPs before applying them. That way we can maintain the pretty SCPs in our customization project.
Additional context
It is difficult to maintain and review changes to minified JSON documents in git. I have many SCPs that push the limits of SCP size due to the limitations of SCP policies.
In IAM policies you can use multiple wildcards in an action statement, but in SCP policies it only supports one wildcard. So I often have to expand 1 action pattern into many to achieve the same goal. For example:
-
iam:*User*
works in IAM policies but not in SCP which leads to a much longer policy in SCP.
@rjenks Thanks for bringing this to our attention. We have added this to our backlog.