Custom IAM policy

0

Hi Community,

assume we have the following policy for an IAM user

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:GetUser",
                "iam:CreateUser",
                "iam:CreateAccessKey"
            ],
            "Resource": "arn:aws:iam::*:user/iot.*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "iam:AddUserToGroup",
            "Resource": "arn:aws:iam::*:group/CUSTOMGROUP"
        }
    ]
}

He should now be able to perform GetUser, CreateUser and CreateAccessKey for all IAM users starting with iot. Second rule should allow him to add IAM user to the Group CUSTOMGROUP

Everything works fine, but I want that the user is only allowed to add other IAM users starting with iot. to the group CUSTOMGROUP How can this be achieved? I was thinking about adding something like

"Condition": {"StringLike": {"iam:user": ["iot.*"]}}

This does not work... any idea if this is possible at all?

hrc
已提问 1 年前235 查看次数
1 回答
2
已接受的回答

Hello,

The action "AddUserToGroup" does not support any condition key. Hence, it is possible to restrict this action on specific username.

Our IAM user guide has a comprehensive listing of each service, and the Access Level required, Resource Types allowed, and Condition Keys that can be used with their actions [1].

However that there is an existing feature request in place for this. As is the case with all feature requests, the internal team takes them seriously and evaluates every request, but we are unable to share any rough ETA for delivering this feature as inclusion of any new feature needs rigorous testing and shall be prioritized along with the team's additional workload. However, any new announcements will be made in our What's New page What's New page [https://aws.amazon.com/new/] and our Official Blog [https://aws.amazon.com/blogs/aws/].

[1]https://docs.aws.amazon.com/service-authorization/latest/reference/list_identityandaccessmanagement.html

AWS
支持工程师
已回答 1 年前
  • excellent and fast feedback, thank you.

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则