Full access policy, except ssmlg...
Hello, i want to create a policy, which will give full permissions, to every resource except ssm, because for the ssm, i want to give a condition.
I can think of 2 variants, of how to do it -
1) Create a policy which will look like
```
"iam:Add*",
"iam:Create*",
"iam:Deactivate*",
"iam:Delete*",
"iam:Detach*",
"iam:Enable*",
"iam:PassRole",
"iam:Put*",
"iam:Remove*",
"iam:Resync*",
"iam:Set*",
"iam:Simulate*",
"iam:Update*",
"iam:Put*"
...
```
but for every resource there is. Then, i need help with finding all of those resource names.
2) while giving full permissions using
```
{
"Statement": [
{
"Action": "*",
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
}
```
Deny access to the ssm, *ONLY* if the ssh document is not used, so i suppose it should look something like
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor1",
"Effect": "Deny",
"Action": "ssm:StartSession",
"Resource": [
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"BoolIfExists": {
"arn:aws:ssm:*:*:document/AWS-StartSSHSession": "false"
}
}
}
]
}
```
But this dosnt seem to be working.
Any help is appreciated.lg...
