AWS Identity and Access Management

用户指南

AWS 文档 » AWS Identity and Access Management » 用户指南 » 访问控制 » 策略和权限 » 示例策略 » IAM：对可应用于新的 IAM 用户、组或角色的托管策略加以限制

IAM：对可应用于新的 IAM 用户、组或角色的托管策略加以限制

此示例显示您可以如何创建策略 对可应用于新的 IAM 用户、组或角色的客户托管和 AWS 托管策略加以限制。此策略提供的权限仅适用于通过 AWS API 或 AWS CLI 完成此操作。要使用此策略，请将示例策略中的红色文本替换为您自己的信息。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:ChangePassword",
                "iam:CreateAccessKey",
                "iam:CreateLoginProfile",
                "iam:CreateUser",
                "iam:DeleteAccessKey",
                "iam:DeleteLoginProfile",
                "iam:DeleteUser",
                "iam:UpdateAccessKey",
                "iam:ListAttachedUserPolicies",
                "iam:ListPolicies",
                "iam:ListUserPolicies",
                "iam:ListGroups",
                "iam:ListGroupsForUser",
                "iam:GetPolicy",
                "iam:GetAccountSummary"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:AttachUserPolicy",
                "iam:DetachUserPolicy"
            ],
            "Resource": "*",
            "Condition": {"ArnEquals": {"iam:PolicyARN": [
                "arn:aws:iam::123456789012:policy/Pol1",
                "arn:aws:iam::aws:policy/Pol2"
            ]}}
        }
    ]
}