试图赋予IAM用户创建和分配角色的权限，但限制了可用策略的类型。

Question

我试图给用户创建角色的权利（因为我没有提供创建访问键的权利）。

我想出了一个策略来允许用户创建和分配角色，我的问题是，现在，用户可以用 "AdministratorAccess "的策略创建一个角色，即使他们不是管理员。 有没有办法在选项列表中拒绝某些策略？

AWS Security Blog

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": [
        "iam:CreateInstanceProfile",
        "iam:UpdateAssumeRolePolicy",
        "iam:ListRoleTags",
        "iam:UntagRole",
        "iam:PutRolePermissionsBoundary",
        "iam:TagRole",
        "iam:RemoveRoleFromInstanceProfile",
        "iam:CreateRole",
        "iam:AttachRolePolicy",
        "iam:PutRolePolicy",
        "iam:ListInstanceProfilesForRole",
        "iam:PassRole",
        "iam:DetachRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:ListAttachedRolePolicies",
        "iam:ListRolePolicies",
        "iam:ListPolicies",
        "iam:GetRole",
        "iam:ListRoles",
        "iam:DeleteRole",
        "iam:UpdateRoleDescription",
        "iam:CreateServiceLinkedRole",
        "iam:UpdateRole",
        "iam:DeleteServiceLinkedRole",
        "iam:GetRolePolicy"
      ],
      "Resource": "*",
      "Condition": {
        "BoolIfExists": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyAdmin",
            "Effect": "Deny",
            "Action": [
                "iam:*"
            ],
            "Resource": "*",
            "Condition": {
                "ArnEquals": {
                    "iam:PolicyArn": [
                        "arn:aws:iam::aws:policy/AdministratorAccess"
                    ]
                }
            }
        }
    ]
}

So using directions from John Rotenstein and finally realizing where I went wrong the way to get what I want is to add the following Permissions Boundary to the user:

Where I went wrong was thinking that I need to Deny, but the Boundary is an AND restraint so I can allow all as long as it is not AdministratorAccess, then the other policies will give the actual actions

谢谢了。

Answer 1

根据我所看到的，权限边界可能是正确的方法，但我还不能完全理解，所以我犹豫是否要把它标记为 "正确答案"。

我试图给用户创建角色的权限（因为我没有提供创建访问键的权限）。我想出了一个策略来允许用户创建和分配角色。我的问题是...你可以使用AWS IAM的权限边界。

IAM实体的权限边界 - AWS身份和访问管理。

Answer 2

下面是AWS安全博客上的一步步介绍。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BoundaryAllowAllNotAdminAccess",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "ArnNotEquals": {
                    "iam:PolicyArn": [
                        "arn:aws:iam::aws:policy/AdministratorAccess"
                    ]
                }
            }
        }
    ]
}

通过使用IAM权限边界资源将权限管理委托给开发者，只要不使用AdministratorAccess，AWS就会允许。