Amazon Virtual Private Cloud endpoint policies for Account Management - Amazon Account Management
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon Virtual Private Cloud endpoint policies for Account Management

You can create a Amazon VPC endpoint policy for Account Management in which you specify the following:

  • The principal that can perform actions.

  • The actions that the principals can perform.

  • The resources on which the actions can be performed.

The following example shows an Amazon VPC endpoint policy that allows one IAM user named Alice in account 123456789012 to both retrieve and change the alternate contact information for any Amazon Web Services account, but denies all IAM users permission to delete any alternate contact information on any account.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "account:GetAlternateContact",
                "account:PutAlternateContact"
            ],
            "Resource": "arn:aws-cn::iam:*:account,
            "Effect": "Allow",
            "Principal": {
              "AWS": "arn:aws-cn::iam:123456789012:user/Alice"
            }
        },
        {
            "Action": "account:DeleteAlternateContact",
            "Resource": "*",
            "Effect": "Deny",
            "Principal": "arn:aws-cn::iam:*:root"
        }
    ]
}

If you want to grant access to accounts that are part of an Amazon Organization to a principal that is in one of the organization's member accounts, then the Resource element must use the following format:

arn:aws-cn:account::{ManagementAccountId}:account/o-{OrganizationId}/{AccountId}

For more information about creating endpoint policies, see Controlling Access to Services with VPC Endpoints in the Amazon PrivateLink Guide.