Testing your organization’s policies in AWS Organization
- If you sign in as a user in the master account, you can perform any operation that is allowed by your IAM permissions policies. The SCPs don’t affect any user or role in the master account, no matter which root or OU the account is located in.
- If you sign in as the root user or an IAM user in account 222222222222, you can perform any actions that are allowed by the allow list. AWS Organizations denies any attempt to perform an action in any service that isn’t in the allow list. Also, AWS Organizations denies any attempt to perform one of the CloudTrail configuration actions.
- If you sign in as a user in account 333333333333, you can perform any actions that are allowed by the allow list and not blocked by the deny list. AWS Organizations denies any attempt to perform an action that isn’t in the allow list policy and any action that is in the deny list policy. Also, AWS Organizations denies any attempt to perform one of the CloudTrail configuration actions.
Comments are closed, but trackbacks and pingbacks are open.