2 Respostas
- Mais recentes
- Mais votos
- Mais comentários
0
I could be wrong but, if you write a permission boundary with a DENY statement to block the one thing you don’t want that user/role to do, you would still need an ALLOW * statement or they can’t do anything.
0
The actions for
sso:CreatePermissionSet
and
sso:CreateAccountAssignmentare
separate actions and don't have a permission boundary property since the Permission Boundary attachment is a separate action:
PutPermissionBoundaryToPermissionSet
i have checked the IAM policies and its current landscape. iam:PermissionsBoundary does not impact anything on the overall effects and actions in cases sso: related activities
respondido há um ano
Conteúdo relevante
- AWS OFICIALAtualizada há 3 anos