1 個回答
- 最新
- 最多得票
- 最多評論
1
Hello.
Permission boundaries, when set, restrict even IAM groups.
Permission boundaries can only be set for IAM users and IAM roles.
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html#access_policies_boundaries-eval-logic
Identity-based policies with boundaries – Identity-based policies are inline or managed policies that are attached to a user, group of users, or role. Identity-based policies grant permission to the entity, and permissions boundaries limit those permissions. The effective permissions are the intersection of both policy types. An explicit deny in either of these policies overrides the allow.
AWS supports permissions boundaries for IAM entities (users or roles).
相關內容
- 已提問 7 個月前
- 已提問 1 年前
doesn't this mean that Identity-based policies can be used on user, group of users, or role and permissions boundaries limit those permissions.