使用 Amazon 开发工具包从用户分离 IAM policy - Amazon Identity and Access Management
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 Amazon Web Services 服务入门

使用 Amazon 开发工具包从用户分离 IAM policy

以下代码示例显示如何从用户分离 IAM policy。

Go
SDK for Go V2
注意

在 GitHub 上查看更多内容。查找完整示例,学习如何在 Amazon 代码示例存储库中进行设置和运行。

package main import ( "context" "flag" "fmt" "github.com/aws/aws-sdk-go-v2/config" "github.com/aws/aws-sdk-go-v2/service/iam" ) // IAMDetachRolePolicyAPI defines the interface for the DetachRolePolicy function. // We use this interface to test the function using a mocked service. type IAMDetachRolePolicyAPI interface { DetachRolePolicy(ctx context.Context, params *iam.DetachRolePolicyInput, optFns ...func(*iam.Options)) (*iam.DetachRolePolicyOutput, error) } // DetachDynamoFullPolicy detaches an Amazon DynamoDB full-access policy from an AWS Identity and Access Management (IAM) role. // Inputs: // c is the context of the method call, which includes the AWS Region. // api is the interface that defines the method call. // input defines the input arguments to the service call. // Output: // If successful, a DetachRolePolicyOutput object containing the result of the service call and nil. // Otherwise, nil and an error from the call to DetachRolePolicy. func DetachDynamoFullPolicy(c context.Context, api IAMDetachRolePolicyAPI, input *iam.DetachRolePolicyInput) (*iam.DetachRolePolicyOutput, error) { return api.DetachRolePolicy(c, input) } func main() { roleName := flag.String("r", "", "The name of the IAM role") flag.Parse() if *roleName == "" { fmt.Println("You must supply a role name (-r ROLE)") return } cfg, err := config.LoadDefaultConfig(context.TODO()) if err != nil { panic("configuration error, " + err.Error()) } client := iam.NewFromConfig(cfg) policyArn := "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess" input := &iam.DetachRolePolicyInput{ PolicyArn: &policyArn, RoleName: roleName, } _, err = DetachDynamoFullPolicy(context.TODO(), client, input) if err != nil { fmt.Println("Unable to detach DynamoDB full-access role policy from role") return } fmt.Println("Role detached successfully") }
  • 有关 API 详细信息,请参阅《Amazon SDK for Go API 参考》中的 DetachUserPolicy

Python
适用于 Python (Boto3) 的 SDK
注意

GitHub 上还有更多内容。查找完整示例,学习如何在 Amazon 代码示例存储库中进行设置和运行。

def detach_policy(user_name, policy_arn): """ Detaches a policy from a user. :param user_name: The name of the user. :param policy_arn: The Amazon Resource Name (ARN) of the policy. """ try: iam.User(user_name).detach_policy(PolicyArn=policy_arn) logger.info("Detached policy %s from user %s.", policy_arn, user_name) except ClientError: logger.exception( "Couldn't detach policy %s from user %s.", policy_arn, user_name) raise
  • 有关 API 详细信息,请参阅《Amazon SDK for Python(Boto3)API 参考》中的 DetachUserPolicy

Rust
SDK for Rust
注意

本文档适用于预览版中的软件开发工具包。软件开发工具包可能随时发生变化,不应在生产环境中使用。

注意

在 GitHub 上查看更多内容。查找完整示例,学习如何在 Amazon 代码示例存储库中进行设置和运行。

pub async fn detach_user_policy( client: &iamClient, user_name: &str, policy_arn: &str, ) -> Result<(), iamError> { client .detach_user_policy() .user_name(user_name) .policy_arn(policy_arn) .send() .await?; Ok(()) }
  • 有关 API 详细信息,请参阅《Amazon SDK for Rust API 参考》中的 DetachUserPolicy

有关 Amazon 软件开发工具包开发人员指南和代码示例的完整列表,请参阅 将 IAM 与 Amazon 开发工具包配合使用。本主题还包括有关入门的信息以及有关先前的软件开发工具包版本的详细信息。