2回答
- 新しい順
- 投票が多い順
- コメントが多い順
0
I could be wrong but, if you write a permission boundary with a DENY statement to block the one thing you don’t want that user/role to do, you would still need an ALLOW * statement or they can’t do anything.
0
The actions for
sso:CreatePermissionSet
and
sso:CreateAccountAssignmentare
separate actions and don't have a permission boundary property since the Permission Boundary attachment is a separate action:
PutPermissionBoundaryToPermissionSet
i have checked the IAM policies and its current landscape. iam:PermissionsBoundary does not impact anything on the overall effects and actions in cases sso: related activities
回答済み 1年前
関連するコンテンツ
- AWS公式更新しました 1年前