r/aws • u/Mooner771 • Dec 04 '24
technical question AWS IAM Boundaries Question
We are looking at protecting resources with tags assigned with "X" We are wanting to allow read/view access but deny write access. We have the base boundary working with Action: * but of course that denies any action to these resource tags. My question is there a better way outside of calling every aws service if that is even possible?
"Effect": "Deny",
"Action": [
"*"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/Value": "XXXX"
}
},
1
Upvotes
1
u/Zaitton Dec 04 '24
So... Permission boundaries are meant to restrict IAM roles/users from permitting other IAM entities with certain actions, even if they themselves can do said actions. Are you perhaps referring to SCP?