Blocking account level write actions

Question

Currently set of admin users can close the account. Trying to come up with a policy to prevent the users from doing it and this is the policy I wrote.

`{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Deny",
            "Action": [
                  "account:CloseAccount"
               ],
            "Resource": "*"
        }
    ]
}`

Even after the above policy, I am able to see the Close Account action on the web page.
![Screenshot](/media/postImages/original/IMWDASVQqSTmS8xvawlG1GNQ)

Answer

Hi,

Could you please confirm whether this is working with
```
"Resource": "*"
```

and if it is working, please make sure that the account arns you mentioned in resource block is correct.

Answer

Hi there, The policy you have mentioned needs a correction.

Instead of 
```
account:CloseAccount
```
use

```
organizations:CloseAccount
```
Then the policy will be as follows

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Deny",
            "Action": [
                "organizations:CloseAccount",
            ],
            "Resource": "*"
        }
    ]
}
```

Reference: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_close.html

Blocking account level write actions

相关内容