2 Respuestas
- Más nuevo
- Más votos
- Más comentarios
0
I could be wrong but, if you write a permission boundary with a DENY statement to block the one thing you don’t want that user/role to do, you would still need an ALLOW * statement or they can’t do anything.
0
The actions for
sso:CreatePermissionSet
and
sso:CreateAccountAssignmentare
separate actions and don't have a permission boundary property since the Permission Boundary attachment is a separate action:
PutPermissionBoundaryToPermissionSet
i have checked the IAM policies and its current landscape. iam:PermissionsBoundary does not impact anything on the overall effects and actions in cases sso: related activities
respondido hace un año
Contenido relevante
- OFICIAL DE AWSActualizada hace 3 meses
- OFICIAL DE AWSActualizada hace 2 años