CODEWITHSUNDEEP
amazon-web-servicesamazon-iam
Mandy
Mandy

Reputation: 33

AWS Policy Restrict Permission Based On Service

I need to provide IAM role creation permission to a user but with a condition that if he does it only from some AWS service. For example, if a user running cloudformation stack and attempting to create an IAM role, he should be allowed. if he manually creating role it should be denied. or if a person creating a codepipeline he should have permission to create the role.

Upvotes: 0

Views: 173

Answers (1)

Dude0001
Dude0001

Reputation: 3430

The concept you are looking for sounds like service-linked roles.

https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html

https://aws.amazon.com/blogs/security/introducing-an-easier-way-to-delegate-permissions-to-aws-services-service-linked-roles/

However, I don't think it is supported for CloudFormation or CodePipeline

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html

Upvotes: 1

Related Questions