CODEWITHSUNDEEP
amazon-iam
David Williams
David Williams

Reputation: 441

Trying to create an AWS policy that all allows everything except deletes

I'm looking to create a policy that allows access to all AWS services except for the Delete permissions. I see that I can do the following but you have to label every AWS service and "*:Delete*" doesn't work. Is there an easier way to allow all services except for the Delete permissions?

...
"Effect": "Allow",
  "NotAction": [
    "application-autoscaling:Delete*",
    "autoscaling:Delete*"
  ],
  "Resource": "*"
  ...

Upvotes: 1

Views: 865

Answers (1)

Oresztesz
Oresztesz

Reputation: 2430

According to the official IAM documentation you have to list all the services.

Based on the grammar you can either define "NotAction": "*" or "NotAction": ["s3:Delete*", "ec2:Delete*", ...]

For further info see action_string section here and policy grammar here.

Upvotes: 1

Related Questions