Allow Selected Services By Region

scp-allow-selected-services-by-region.json

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "AllowServicesListedBelow",
			"Effect": "Allow",
			"Action": [
				"account:*",
				"access-analyzer:*",
				"autoscaling:*",
				"autoscaling-plans:*",
				"aws-portal:*",
				"billing:*",
				"budgets:*",
				"cloudformation:*",
				"cloudfront:*",
				"cloudshell:*",
				"cloudtrail:*",
				"cloudtrail-data:*",
				"cloudwatch:*",
				"ce:*",
				"ec2:*",
				"elasticfilesystem:*",
				"elasticloadbalancing:*",
				"freetier:*",
				"lambda:*",
				"route53:*",
				"s3:*",
				"secretsmanager:*",
				"ssm:*"
            ],
			"Resource": "*"
		},
		{
			"Sid": "DenyAllServicesExceptInRegionsListedBelow",
			"Effect": "Deny",
			"Action": "*",
			"Resource": "*",
			"Condition": {
				"StringNotEqualsIgnoreCase": {
					"aws:RequestedRegion": [
						"us-east-1",
						"us-east-2",
						"us-west-2"
					]
				}
			}
		}
	]
}