Minor cleanups

[Nuru]

what

Minor fixes to several SCPs

• DenyLambdaWithoutVpc was previously invalid. It is now valid, but has not been thoroughly tested to ensure it does what it promises.
• DenyRDSUnencrypted was fixed to deny rds:RestoreDBClusterFromSnapshot when not encrypted. Previously this action was not denied, and instead the nonexistent RestoreDBClusterFromDBSnapshot was denied
• The DenyS3BucketsPublicAccess policy was cleaned up by eliminating the nonexistent s3:DeletePublicAccessBlock action. Note that it still is probably not something you want to use, because it denies enabling a public access block as well as removing one. We hope to have a better policy in the future.
• The Region Restriction Templates DenyRegions and RestrictToSpecifiedRegions were updated to exclude the account, artifact, and supportplans services from region restrictions, since they are global services. The obsolete awsbillingconsole service was removed.
• DenyS3InNonSelectedRegion was fixed to allow users to allow S3 bucket creation in us-east-1. Previously us-east-1 was always prohibited even when expressly allowed, due to quirks in S3.

why

• Restore intended behavior

references

• Closes Some global services are denied by region control policies #33

[dudymas]

LGTM

for what it's worth, DeletePublicAccessBlock does require PUT permissions so you don't need to keep it in the deny policy, but you can always leave it in the policy to help folks know that it's denied.

[Nuru]

LGTM

for what it's worth, DeletePublicAccessBlock does require PUT permissions so you don't need to keep it in the deny policy, but you can always leave it in the policy to help folks know that it's denied.

DeletePublicAccessBlock is not a valid IAM permission and, when given the opportunity, policy validators complain about it, which is why I removed it. Like you said, the DeletePublicAccessBlock action requires the PutBucketPublicAccessBlock permission. (ref)