Custom IAM policy

0

Hi Community,

assume we have the following policy for an IAM user

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:GetUser",
                "iam:CreateUser",
                "iam:CreateAccessKey"
            ],
            "Resource": "arn:aws:iam::*:user/iot.*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "iam:AddUserToGroup",
            "Resource": "arn:aws:iam::*:group/CUSTOMGROUP"
        }
    ]
}

He should now be able to perform GetUser, CreateUser and CreateAccessKey for all IAM users starting with iot. Second rule should allow him to add IAM user to the Group CUSTOMGROUP

Everything works fine, but I want that the user is only allowed to add other IAM users starting with iot. to the group CUSTOMGROUP How can this be achieved? I was thinking about adding something like

"Condition": {"StringLike": {"iam:user": ["iot.*"]}}

This does not work... any idea if this is possible at all?

1回答
2
承認された回答

Hello,

The action "AddUserToGroup" does not support any condition key. Hence, it is possible to restrict this action on specific username.

Our IAM user guide has a comprehensive listing of each service, and the Access Level required, Resource Types allowed, and Condition Keys that can be used with their actions [1].

However that there is an existing feature request in place for this. As is the case with all feature requests, the internal team takes them seriously and evaluates every request, but we are unable to share any rough ETA for delivering this feature as inclusion of any new feature needs rigorous testing and shall be prioritized along with the team's additional workload. However, any new announcements will be made in our What's New page What's New page [https://aws.amazon.com/new/] and our Official Blog [https://aws.amazon.com/blogs/aws/].

[1]https://docs.aws.amazon.com/service-authorization/latest/reference/list_identityandaccessmanagement.html

AWS
サポートエンジニア
回答済み 1年前
  • excellent and fast feedback, thank you.

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ