Mapping fine-grained IAM actions reference

Overview

1. Review your affected IAM policies in your Amazon Web Services account. To do so, follow the steps in the Affected policies tool to identify your affected IAM policies. See How to use the affected policies tool.

2. Use the IAM console to add the new granular permissions to your policy. For example, if your policy allows the purchase-orders:ModifyPurchaseOrders permission, you will need to add each action in the Mapping for purchase-orders:ModifyPurchaseOrders table.

   Old policy

   The following policy allows a user to add, delete, or modify any purchase order in the account.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": "purchase-orders:ModifyPurchaseOrders",
               "Resource": "arn:aws:purchase-orders::123456789012:purchase-order/*"
           }
       ]
   }

   New policy

   The following policy also allows a user to add, delete, or modify any purchase order in the account. Note that each granular permission appears after the old purchase-orders:ModifyPurchaseOrders permission. These permissions give you more control over what actions you want to allow or deny.

   Tip

   We recommend that you keep the old permissions to ensure that you don't lose permissions until this migration is complete.

   {
   	"Version": "2012-10-17",
   	"Statement": [
   		{
   			"Sid": "VisualEditor0",
   			"Effect": "Allow",
   			"Action": [
   				"purchase-orders:ModifyPurchaseOrders",
   				"purchase-orders:AddPurchaseOrder",
   				"purchase-orders:DeletePurchaseOrder",
   				"purchase-orders:UpdatePurchaseOrder",
   				"purchase-orders:UpdatePurchaseOrderStatus"
   			],
   			"Resource": "arn:aws:purchase-orders::123456789012:purchase-order/*"
   		}
   	]
   }

3. Save your changes.