CODEWITHSUNDEEP
jsonamazon-iam
Vikas Satpute
Vikas Satpute

Reputation: 174

This policy contains the following error: Has prohibited field Principal

I am allowing action from only specified range of ip address and denies aceess for rest ip's.

{
"Version": "2012-10-17",
"Statement": [{
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::510680944440:user/wu-core-dev-auto-start-stop-lambda-invoke"
    },
    "Action": "sts:AssumeRole",

    "Condition": {
        "IpAddress": {
            "aws:SourceIp": [
                "10.38.6.123/24"
            ]
        }
    }
}]

}

Upvotes: 1

Views: 5041

Answers (1)

marcincuber
marcincuber

Reputation: 3791

So, from the official AWS docs we know the following;

Use the Principal element to specify the IAM user, federated user, IAM role, AWS account, AWS service, or other principal entity that is allowed or denied access to a resource. You cannot use the Principal element in an IAM identity-based policy. You can use it in the trust policies for IAM roles and in resource-based policies. Resource-based policies are policies that you embed directly in an IAM resource.

Assuming that answers your question, my proposed solution would be simple;

  1. Remove Principal block from your policy
  2. Add "Resource": "arn:aws:iam::510680944440:user/wu-core-dev-auto-start-stop-lambda-invoke"

More on principals -> AWS docs

Upvotes: 1

Related Questions