Managed policies for your organization
Warning
We're currently releasing our new experience to a limited number of customers. You might not be able to access this experience yet.
When you use our new Amazon experience, Amazon manages the organization management policies including the resource control policies (RCPs) and the service control policies (SCPs). These protective controls prevent a project owner or team member from performing actions that would inhibit the preconfigured defaults Amazon has defined to help you build and develop quickly.
Service control policies for projects
The following is a service control policy for all users in a project and cannot be changed:
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "BlockOrgEscape", "Effect" : "Deny", "Action" : [ "account:CloseAccount", "organizations:AcceptHandshake", "organizations:LeaveOrganization", "sso:CreateInstance" ], "Resource" : "*" }, { "Sid" : "ProtectManagedRoles", "Effect" : "Deny", "Action" : [ "iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePermissionsBoundary", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePermissionsBoundary", "iam:PutRolePolicy", "iam:TagRole", "iam:UntagRole", "iam:UpdateAssumeRolePolicy", "iam:UpdateRole" ], "Resource" : "arn:*:iam::*:role/managed/*", "Condition" : { "StringNotLike" : { "aws:PrincipalArn" : "arn:*:iam::*:role/managed/AWSManagedAccountManagementAccessRole" } } } ] }
This policy is not removed when you activate advanced features. For more information, see Activate advanced Amazon features.
In addition, we apply the following service control policy for all users in a project to restrict certain modifications to your project that are either not supported or must be completed in Amazon Settings:
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "BlockAccountManagementAPIs", "Effect" : "Deny", "Action" : [ "account:AcceptPrimaryEmailUpdate", "account:DeleteAlternateContact", "account:DisableRegion", "account:EnableRegion", "account:GetAlternateContact", "account:GetContactInformation", "account:GetGovCloudAccountInformation", "account:GetRegionOptStatus", "account:PutAccountName", "account:PutAlternateContact", "account:PutContactInformation", "account:StartPrimaryEmailUpdate" ], "Resource" : "*" }, { "Sid" : "DenyBillingOperations", "Effect" : "Deny", "Action" : "billing:*", "Resource" : "*" }, { "Sid" : "DenyNotificationContactsOperations", "Effect" : "Deny", "Action" : "notifications-contacts:*", "Resource" : "*" }, { "Sid" : "DenyRestrictedNotificationOperations", "Effect" : "Deny", "Action" : [ "notifications:AssociateChannel", "notifications:AssociateManagedNotificationAccountContact", "notifications:AssociateManagedNotificationAdditionalChannel", "notifications:AssociateOrganizationalUnit", "notifications:CreateEventRule", "notifications:CreateNotificationConfiguration", "notifications:DeleteEventRule", "notifications:DeleteNotificationConfiguration", "notifications:DeregisterNotificationHub", "notifications:DisableNotificationsAccessForOrganization", "notifications:DisassociateChannel", "notifications:DisassociateManagedNotificationAccountContact", "notifications:DisassociateManagedNotificationAdditionalChannel", "notifications:DisassociateOrganizationalUnit", "notifications:EnableNotificationsAccessForOrganization", "notifications:GetEventRule", "notifications:GetFeatureOptInStatus", "notifications:GetNotificationConfiguration", "notifications:GetNotificationEvent", "notifications:GetNotificationsAccessForOrganization", "notifications:ListChannels", "notifications:ListEventRules", "notifications:ListManagedNotificationChannelAssociations", "notifications:ListMemberAccounts", "notifications:ListNotificationConfigurations", "notifications:ListNotificationEvents", "notifications:ListNotificationHubs", "notifications:ListOrganizationalUnits", "notifications:ListTagsForResource", "notifications:PutFeatureOptInStatus", "notifications:RegisterNotificationHub", "notifications:TagResource", "notifications:UntagResource", "notifications:UpdateEventRule", "notifications:UpdateNotificationConfiguration" ], "Resource" : "*" }, { "Sid" : "DenyRoleManagerDisablement", "Effect" : "Deny", "Action" : "iam:PutAccountProperties", "Resource" : "*", "Condition" : { "ForAnyValue:StringEquals" : { "iam:AccountPropertyNamespaces" : "RoleManager" } } } ] }
This policy is removed when you activate advanced features. For more information, see Activate advanced Amazon features.
In addition, we also apply the following service control policy for all users in a project
to restrict Amazon Web Services Regions to allow for support for partitional services, depending on your
selected-region:
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "UsEast1Partitional", "Effect" : "Deny", "NotAction" : [ "account:*", "acm:AddTagsToCertificate", "acm:DeleteCertificate", "acm:DescribeCertificate", "acm:GetCertificate", "acm:ListCertificates", "acm:ListTagsForCertificate", "acm:RemoveTagsFromCertificate", "acm:RequestCertificate", "acm:ResendValidationEmail", "activate:*", "appfabric:*", "artifact:*", "aws-marketplace:*", "bedrock-mantle:CallWithBearerToken", "bedrock-mantle:CreateInference", "bedrock-mantle:GetInference", "bedrock-mantle:GetModel", "bedrock-mantle:ListModels", "bedrock:ApplyGuardrail", "bedrock:CountTokens", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListFoundationModels", "bedrock:ListInferenceProfiles", "budgets:*", "ce:*", "chatbot:*", "cloudfront-keyvaluestore:*", "cloudfront:*", "cloudshell:*", "cloudtrail:LookupEvents", "consoleapp:*", "cost-optimization-hub:*", "ec2:DescribeRegions", "ecr-public:*", "freetier:*", "health:*", "iam:*", "identitystore-auth:*", "identitystore:*", "invoicing:*", "kms:CreateGrant", "kms:Decrypt", "kms:DescribeKey", "kms:ListAliases", "machinelearning:*", "managedblockchain-query:*", "managedblockchain:*", "mapcredits:*", "notifications:GetManagedNotificationConfiguration", "notifications:GetManagedNotificationEvent", "notifications:ListManagedNotificationChildEvents", "notifications:ListManagedNotificationConfigurations", "notifications:ListManagedNotificationEvents", "organizations:*", "q:*", "route53:*", "route53domains:*", "route53globalresolver:*", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "signin:*", "sso-directory:*", "sso-oauth:*", "sso:*", "sts:*", "support:*", "tax:*", "trustedadvisor:*", "uxc:*", "waf:*" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:RequestedRegion" : "us-east-1" } } }, { "Sid" : "DenyUsEast1AcmPrivateCaRequests", "Effect" : "Deny", "Action" : "acm:RequestCertificate", "Resource" : "*", "Condition" : { "Null" : { "acm:CertificateAuthority" : "false" }, "StringEquals" : { "aws:RequestedRegion" : "us-east-1" } } }, { "Sid" : "UsWest2Partitional", "Effect" : "Deny", "NotAction" : [ "bedrock-mantle:CallWithBearerToken", "bedrock-mantle:CreateInference", "bedrock-mantle:GetInference", "bedrock-mantle:GetModel", "bedrock-mantle:ListModels", "bedrock:ApplyGuardrail", "bedrock:CountTokens", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListFoundationModels", "bedrock:ListInferenceProfiles", "cloudshell:*", "cloudtrail:LookupEvents", "health:*", "identitystore-auth:*", "identitystore:*", "kms:Decrypt", "kms:DescribeKey", "kms:ListAliases", "networkmanager-chat:*", "networkmanager:*", "route53-recovery-cluster:*", "route53-recovery-control-config:*", "route53-recovery-readiness:*", "sso-directory:*", "sso-oauth:*", "sso:*", "support:*", "trustedadvisor:*", "uxc:*" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:RequestedRegion" : "us-west-2" } } }, { "Sid" : "RegionFloor", "Effect" : "Deny", "NotAction" : [ "bedrock-mantle:CallWithBearerToken", "bedrock-mantle:CreateInference", "bedrock-mantle:GetInference", "bedrock-mantle:GetModel", "bedrock-mantle:ListModels", "bedrock:ApplyGuardrail", "bedrock:CountTokens", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListFoundationModels", "bedrock:ListInferenceProfiles" ], "Resource" : "*", "Condition" : { "StringNotEquals" : { "aws:RequestedRegion" : [ "unspecified", "us-east-1", "selected-region", "us-west-2" ] } } } ] }
After you activate advanced features, the following service control policy is applied to your account:
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "UsEast1Partitional", "Effect" : "Deny", "NotAction" : [ "a4b:*", "access-analyzer:*", "account-access:*", "account:*", "acm:*", "activate:*", "appfabric:*", "artifact:*", "aws-marketplace-management:*", "aws-marketplace:*", "aws-portal:*", "bedrock-mantle:CallWithBearerToken", "bedrock-mantle:CreateInference", "bedrock-mantle:GetInference", "bedrock-mantle:GetModel", "bedrock-mantle:ListModels", "bedrock:ApplyGuardrail", "bedrock:CountTokens", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListFoundationModels", "bedrock:ListInferenceProfiles", "billing:*", "billingconductor:*", "budgets:*", "builderid:*", "ce:*", "chatbot:*", "chime:*", "cloudfront-keyvaluestore:*", "cloudfront:*", "cloudshell:*", "cloudtrail:LookupEvents", "compute-optimizer:*", "config:*", "consoleapp:*", "consolidatedbilling:*", "cost-optimization-hub:*", "cur:*", "datapipeline:GetAccountLimits", "devicefarm:*", "directconnect:*", "ec2:DescribeRegions", "ec2:DescribeTransitGateways", "ec2:DescribeVpnGateways", "ecr-public:*", "fms:*", "freetier:*", "globalaccelerator:*", "health:*", "iam:*", "identitystore-auth:*", "identitystore:*", "importexport:*", "invoicing:*", "iq:*", "kms:*", "license-manager:ListReceivedLicenses", "lightsail:Get*", "machinelearning:*", "managedblockchain-query:*", "managedblockchain:*", "mapcredits:*", "mobileanalytics:*", "networkmanager:*", "notifications-contacts:*", "notifications:*", "organizations:*", "payments:*", "pricing:*", "q:*", "quicksight:DescribeAccountSubscription", "resource-explorer-2:*", "route53-recovery-cluster:*", "route53-recovery-control-config:*", "route53-recovery-readiness:*", "route53:*", "route53domains:*", "route53globalresolver:*", "s3:CreateMultiRegionAccessPoint", "s3:DeleteMultiRegionAccessPoint", "s3:DescribeMultiRegionAccessPointOperation", "s3:GetAccountPublicAccessBlock", "s3:GetBucketLocation", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetStorageLensConfiguration", "s3:GetStorageLensDashboard", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3:PutAccountPublicAccessBlock", "s3:PutMultiRegionAccessPointPolicy", "savingsplans:*", "shield:*", "signin:*", "sso-directory:*", "sso-oauth:*", "sso:*", "sts:*", "support:*", "supportapp:*", "supportplans:*", "sustainability:*", "tag:GetResources", "tax:*", "trustedadvisor:*", "uxc:*", "vendor-insights:ListEntitledSecurityProfiles", "waf-regional:*", "waf:*", "wafv2:*" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:RequestedRegion" : "us-east-1" } } }, { "Sid" : "UsWest2Partitional", "Effect" : "Deny", "NotAction" : [ "bedrock-mantle:CallWithBearerToken", "bedrock-mantle:CreateInference", "bedrock-mantle:GetInference", "bedrock-mantle:GetModel", "bedrock-mantle:ListModels", "bedrock:ApplyGuardrail", "bedrock:CountTokens", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListFoundationModels", "bedrock:ListInferenceProfiles", "cloudshell:*", "cloudtrail:LookupEvents", "health:*", "identitystore-auth:*", "identitystore:*", "kms:Decrypt", "kms:DescribeKey", "kms:ListAliases", "networkmanager-chat:*", "networkmanager:*", "route53-recovery-cluster:*", "route53-recovery-control-config:*", "route53-recovery-readiness:*", "sso-directory:*", "sso-oauth:*", "sso:*", "support:*", "trustedadvisor:*", "uxc:*" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:RequestedRegion" : "us-west-2" } } }, { "Sid" : "RegionFloor", "Effect" : "Deny", "NotAction" : [ "bedrock-mantle:CallWithBearerToken", "bedrock-mantle:CreateInference", "bedrock-mantle:GetInference", "bedrock-mantle:GetModel", "bedrock-mantle:ListModels", "bedrock:ApplyGuardrail", "bedrock:CountTokens", "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability", "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:ListFoundationModels", "bedrock:ListInferenceProfiles" ], "Resource" : "*", "Condition" : { "StringNotEquals" : { "aws:RequestedRegion" : [ "unspecified", "us-east-1", "selected-region", "us-west-2" ] } } } ] }
Service control policies for spend limits
If you use a spend limit, the following service control policies are applied to your project as it nears the spend limit. For more information about spend limits, see Create a spend limit in Amazon Settings.
{ "Version": "2012-10-17", "Statement": { "Sid": "DenyBedrockUsage", "Effect": "Deny", "Action": [ "bedrock:ApplyGuardrail", "bedrock:CallWithBearerToken", "bedrock:InvokeAgent", "bedrock:InvokeAutomatedReasoningPolicy", "bedrock:InvokeDataAutomation", "bedrock:InvokeDataAutomationAsync", "bedrock:InvokeFlow", "bedrock:InvokeInlineAgent", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:InvokeTool", "bedrock:OptimizePrompt", "bedrock:Retrieve", "bedrock:RetrieveAndGenerate", "bedrock:StartFlowExecution", "bedrock-mantle:CallWithBearerToken", "bedrock-mantle:CreateInference" ], "Resource": "*" } }
{ "Version": "2012-10-17", "Statement": { "Sid": "DenyLambdaUsage", "Effect": "Deny", "Action": [ "lambda:DeleteFunctionConcurrency", "lambda:InvokeAsync", "lambda:InvokeFunction", "lambda:InvokeFunctionUrl", "lambda:PutFunctionConcurrency" ], "Resource": "*" } }
{ "Version": "2012-10-17", "Statement": { "Sid": "DenySageMakerInference", "Effect": "Deny", "Action": [ "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:InvokeEndpointWithResponseStream" ], "Resource": "*" } }
{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyCompute", "Effect": "Deny", "Action": [ "ec2:CreateNatGateway", "ec2:CreateVolume", "ec2:CreateVpnConnection", "ec2:RunInstances", "ec2:StartInstances", "elasticloadbalancing:CreateLoadBalancer", "autoscaling:CreateAutoScalingGroup", "ecs:CreateService", "eks:CreateCluster", "eks:CreateNodegroup", "eks:CreateFargateProfile", "elasticbeanstalk:CreateEnvironment", "apprunner:CreateService", "apprunner:ResumeService", "batch:CreateComputeEnvironment", "elasticmapreduce:RunJobFlow", "appstream:CreateFleet" ], "Resource": "*" }, { "Sid": "DenyLambda", "Effect": "Deny", "Action": "lambda:CreateFunction", "Resource": "*" }, { "Sid": "DenyDatabase", "Effect": "Deny", "Action": [ "rds:CreateDBCluster", "rds:CreateDBInstance", "rds:RestoreDBClusterFromS3", "rds:RestoreDBClusterFromSnapshot", "rds:RestoreDBClusterToPointInTime", "rds:RestoreDBInstanceFromDBSnapshot", "rds:RestoreDBInstanceFromS3", "rds:RestoreDBInstanceToPointInTime", "rds:StartDBCluster", "rds:StartDBInstance", "dynamodb:CreateTable", "dynamodb:CreateGlobalTable", "elasticache:CreateCacheCluster", "elasticache:CreateReplicationGroup", "timestream:CreateDatabase", "timestream:CreateTable", "memorydb:CreateCluster", "es:CreateDomain", "aoss:CreateCollection", "redshift:CreateCluster", "redshift:ResumeCluster", "redshift-serverless:CreateWorkgroup", "dsql:CreateCluster" ], "Resource": "*" }, { "Sid": "DenyStorage", "Effect": "Deny", "Action": [ "elasticfilesystem:CreateFileSystem", "datasync:CreateTask", "storagegateway:ActivateGateway", "glacier:CreateVault" ], "Resource": "*" }, { "Sid": "DenySageMaker", "Effect": "Deny", "Action": [ "sagemaker:CreateApp", "sagemaker:CreateEndpoint", "sagemaker:CreateNotebookInstance", "sagemaker:CreateProcessingJob", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:StartNotebookInstance" ], "Resource": "*" }, { "Sid": "DenyBedrock", "Effect": "Deny", "Action": [ "bedrock:CreateCustomModelDeployment", "bedrock:CreateDataAutomationProject", "bedrock:CreateEvaluationJob", "bedrock:CreateMarketplaceModelEndpoint", "bedrock:CreateModelCustomizationJob", "bedrock:CreateModelImportJob", "bedrock:CreateModelInvocationJob", "bedrock:CreateProvisionedModelThroughput", "bedrock-mantle:CreateCustomizedModel", "bedrock-mantle:CreateFineTuningJob", "bedrock-mantle:CreateReservation" ], "Resource": "*" }, { "Sid": "DenyAIML", "Effect": "Deny", "Action": [ "kendra:CreateIndex", "personalize:CreateSolution", "personalize:CreateCampaign", "forecast:CreatePredictor", "forecast:CreateForecast", "rekognition:CreateProject", "lex:CreateBot" ], "Resource": "*" }, { "Sid": "DenyNetworking", "Effect": "Deny", "Action": [ "cloudfront:CreateDistribution", "route53:CreateHostedZone", "appmesh:CreateMesh" ], "Resource": "*" }, { "Sid": "DenyApiGatewayCreate", "Effect": "Deny", "Action": "apigateway:POST", "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/apis" ] }, { "Sid": "DenyMessaging", "Effect": "Deny", "Action": [ "mq:CreateBroker", "kafka:CreateCluster", "kafka:CreateVpcConnection", "kinesis:CreateStream", "firehose:CreateDeliveryStream", "kinesisanalytics:CreateApplication", "kinesisvideo:CreateStream", "sns:CreateTopic", "sqs:CreateQueue", "events:CreateEventBus", "pipes:CreatePipe", "scheduler:CreateSchedule" ], "Resource": "*" }, { "Sid": "DenyAnalytics", "Effect": "Deny", "Action": [ "states:CreateStateMachine", "glue:CreateJob", "glue:CreateCrawler", "athena:CreateWorkGroup", "appsync:CreateGraphqlApi", "appflow:CreateFlow", "datazone:CreateDomain", "datazone:CreateProject", "entityresolution:CreateMatchingWorkflow", "datapipeline:CreatePipeline", "dataexchange:CreateDataSet" ], "Resource": "*" }, { "Sid": "DenyDevTools", "Effect": "Deny", "Action": [ "amplify:CreateApp", "amplify:CreateBranch", "cloud9:CreateEnvironmentEC2", "codebuild:CreateProject", "codepipeline:CreatePipeline", "codedeploy:CreateApplication", "cloudformation:CreateStack", "cloudformation:CreateStackSet", "codeartifact:CreateRepository", "codeartifact:CreateDomain" ], "Resource": "*" }, { "Sid": "DenySecurity", "Effect": "Deny", "Action": [ "kms:CreateKey", "wafv2:CreateWebACL", "cloudhsm:CreateCluster", "network-firewall:CreateFirewall", "secretsmanager:CreateSecret", "acm-pca:CreateCertificateAuthority", "cognito-idp:CreateUserPool", "cognito-identity:CreateIdentityPool", "ds:CreateDirectory", "ds:CreateMicrosoftAD", "fms:PutPolicy", "payment-cryptography:CreateKey" ], "Resource": "*" }, { "Sid": "DenyMedia", "Effect": "Deny", "Action": [ "medialive:CreateChannel", "mediapackage:CreateChannel", "mediaconnect:CreateFlow", "mediatailor:CreateChannel" ], "Resource": "*" }, { "Sid": "DenyIoT", "Effect": "Deny", "Action": [ "iot:CreateThing", "iot:CreateTopicRule", "iotevents:CreateDetectorModel", "iottwinmaker:CreateWorkspace", "iotsitewise:CreateAssetModel", "iotsitewise:CreatePortal", "iotfleetwise:CreateCampaign" ], "Resource": "*" }, { "Sid": "DenyMisc", "Effect": "Deny", "Action": [ "ses:CreateConfigurationSet", "ecr:CreateRepository", "aps:CreateWorkspace", "healthlake:CreateFHIRDatastore", "transfer:CreateServer", "managedblockchain:CreateNetwork", "managedblockchain:CreateMember", "route53-recovery-control-config:CreateCluster", "fis:CreateExperimentTemplate", "appfabric:CreateAppBundle", "appfabric:CreateIngestion", "b2bi:CreateProfile", "b2bi:CreateTransformer", "geo:CreateMap", "geo:CreatePlaceIndex", "geo:CreateTracker", "geo:CreateGeofenceCollection", "geo:CreateRouteCalculator" ], "Resource": "*" } ] }
Resource control policies for projects
The following is the resource control policy for the resources
in the project
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "DenyAnyoneOutsideMyOrgAndAWS", "Effect" : "Deny", "Principal" : "*", "Action" : [ "aoss:*", "appconfig:*", "appstream:*", "autoscaling:*", "codebuild:*", "codecommit:*", "cognito-identity:*", "cognito-idp:*", "comprehend:*", "comprehendmedical:*", "dax:*", "dynamodb:*", "ecr:*", "health:*", "kinesisvideo:*", "kms:*", "logs:*", "s3:*", "secretsmanager:*", "sqs:*", "sts:*", "support:*", "textract:*", "transcribe:*", "translate:*" ], "Resource" : "*", "Condition" : { "BoolIfExists" : { "aws:PrincipalIsAWSService" : "false" }, "Null" : { "aws:PrincipalARN" : "false" }, "StringNotEqualsIfExists" : { "aws:PrincipalOrgID" : "${aws:ResourceOrgID}" } } }, { "Sid" : "DenyAWSWhenItsNotMyOrgsSourceAccount", "Effect" : "Deny", "Principal" : "*", "Action" : [ "aoss:*", "appconfig:*", "appstream:*", "autoscaling:*", "codebuild:*", "codecommit:*", "cognito-identity:*", "cognito-idp:*", "comprehend:*", "comprehendmedical:*", "dax:*", "dynamodb:*", "ecr:*", "health:*", "kinesisvideo:*", "kms:*", "logs:*", "s3:*", "secretsmanager:*", "sqs:*", "sts:*", "support:*", "textract:*", "transcribe:*", "translate:*" ], "Resource" : "*", "Condition" : { "Null" : { "aws:SourceAccount" : "false" }, "StringNotEquals" : { "aws:SourceOrgID" : "${aws:ResourceOrgID}" } } } ] }