SCP Deny policy

Terraform
#1

I was doing one lav session in Terraf. The lab session has an explicity deny policy so I am not able to create VPCorm + AWS

#2

What is “VPCorm”? Even google suggests this might be a typo :slight_smile:

image
image1424×608 116 KB

#3

I guess it’s related to the VPC. Please share the Terraform lab link so we can check it and support you.

#4

I have encountered below error in terraform

root@controlplane ~/code on :cloud: (us-east-1) ➜ aws ec2 describe-vpcs --region ap-south-1 An error occurred (UnauthorizedOperation) when calling the DescribeVpcs operation: You are not authorized to perform this operation. User: arn:aws:iam::590184057482:user/kk_labs_user_732232 is not authorized to perform: ec2:DescribeVpcs with an explicit deny in a service control policy: arn:aws:organizations::598274344262:policy/o-ptvbaba0eu/service_control_policy/p-3m2d0vav root@controlplane ~/code on :cloud: (us-east-1) :heavy_multiplication_x:

Link: AWS+TERRAFORM
https://learn.kodekloud.com/learn/playgrounds/playground-terraform-aws?_gl=1*10h9b6k*_gcl_au*MjA2NDM3NjQ3Mi4xNzg5MTM2NDExLjE4NTAxODY4MjQuMTc4OTEzNjQxOC4xNzg5MTM2NzExLjEzMDkwNjEwNjkuMTc4OTEzNjQxOC4xNzg5MTM2NzEx*_ga*MTU0MzA1MDMzLjE3ODkxMzY0MTI.*_ga_GNM9S6ZZKN*czE3ODkxMzY0MTEkbzEkZzEkdDE3ODkxMzY4MTYkajM4JGwwJGgxMDEzMTAxNTQ1JGR3dDdheUZiRE1yd0Q5bThDWjNoeUNicHdKOEUtRW9DYURB

#5

You appear to be trying to create a VPC in the ap-south-1 region. That’s your problem; that region is not supported in the playground. The playground landing page for AWS tells you what is allowed:

Supported AWS Regions

‍

  • Region Code: us-east-1
  • Region Name: US East (N. Virginia)
    ‍
  • Region Code: us-west-2
  • Region Name: US West (Oregon)

‍

  • Region Code: us-east-2
  • Region Name: US East (Ohio)

So your terraform script needs to use one of those regions in order to create a VPC or pretty much anything else.