登录控制台
AWS Identity and Access Management
用户指南
AWS 文档 » AWS Identity and Access Management » 用户指南 » 访问控制 » IAM 策略 » 示例策略 » IAM：对可应用于新的 IAM 用户、组或角色的托管策略加以限制
AWS 文档中描述的 AWS 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 Amazon AWS 入门。

IAM：对可应用于新的 IAM 用户、组或角色的托管策略加以限制

此示例显示您可以如何创建策略 对可应用于新的 IAM 用户、组或角色的客户托管和 AWS 托管策略加以限制。要使用此策略，请将示例策略中的红色文本替换为您自己的信息。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:ChangePasword",
        "iam:CreateAccessKey",
        "iam:CreateLoginProfile",
        "iam:CreateUser",
        "iam:DeleteAccessKey",
        "iam:DeleteLoginProfile",
        "iam:DeleteUser",
        "iam:UpdateAccessKey",
        "iam:ListAttachedUserPolicies",
        "iam:ListPolicies",
        "iam:ListUserPolicies",
        "iam:ListGroups",
        "iam:ListGroupsForUser",
        "iam:GetPolicy",
        "iam:GetAccountSummary"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:AttachUserPolicy",
        "iam:DetachUserPolicy"
      ],
      "Resource": "*",
      "Condition": {
        "ArnEquals": {
          "iam:PolicyArn": [
            "arn:aws:iam::<ACCOUNTNUMBER>:policy/<MANAGED-POLICY-NAME>",
            "arn:aws:iam::aws:policy/<AWS-MANAGED-POLICY-NAME>"
          ]
        }
      }
    }
  ]
}