Exclude Permissions from an Admin AWS Account?

Question

I want to create a user who has AdministratorAccess and manage everything except for example deny Delete and Update actions in IAM

I tried to do this

Create Admin User
Create a policy that denies Delete and Update Operations in IAM
Attach that policy to the user
User has now (AdministratorAccess + MyPolicy)

But

User is still able to delete and update users in IAM
I think this is because AdministratorAccess

Is there a way to do this, without trying to create a complicated multiple Policies ?

Update

Here is the policy I created

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "StmtXXXX",
            "Effect": "Deny",
            "Action": [
                "iam:ChangePassword",
                "iam:DeactivateMFADevice",
                "iam:DeleteAccessKey",
                "iam:DeleteAccountAlias",
                "iam:DeleteAccountPasswordPolicy",
                "iam:DeleteGroup",
                "iam:DeleteGroupPolicy",
                "iam:DeleteInstanceProfile",
                "iam:DeleteLoginProfile",
                "iam:DeleteOpenIDConnectProvider",
                "iam:DeletePolicy",
                "iam:DeletePolicyVersion",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:DeleteSAMLProvider",
                "iam:DeleteSSHPublicKey",
                "iam:DeleteServerCertificate",
                "iam:DeleteSigningCertificate",
                "iam:DeleteUser",
                "iam:DeleteUserPolicy",
                "iam:DeleteVirtualMFADevice",
                "iam:RemoveClientIDFromOpenIDConnectProvider",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:RemoveUserFromGroup",
                "iam:UpdateAccessKey",
                "iam:UpdateLoginProfile",
                "iam:UpdateSSHPublicKey"
            ],
            "Resource": [
                "arn:aws:iam::1234:user/dummyadmin"
            ]
        }
    ]
}

Update 2

After setting resource to arn:aws:iam::1234, it worked!

`Deny` in an IAM policy *always* overrides `Allow`, if both rules apply to a user... AdministratorAccess should not be exempt from this, so so the most likely explanation is that your deny policy doesn't correctly identity the actions and resources to which you want to deny access. Show the deny policy? — Michael - sqlbot, Dec 02 '16 at 13:30
@Michael-sqlbot I attached the policy I created, could it be because of ARN ? — Eltorrooo, Dec 02 '16 at 14:05
The `Effect` of a policy statement applies when a `Principal` tries to perform an `Action` **against** a *target* `Resource`. The `Principal` is not declared in a user policy, because the `Principal` is any user against whom the policy is applied... so by confusing `Resource` and `Principal`, this was only denying user/dummyadmin from performing actions against itself. — Michael - sqlbot, Dec 02 '16 at 17:37

score 3 · Answer 1 · answered Dec 02 '16 at 16:17

A potentially easier option is to assign permissions for everything except IAM. This can accomplished with this policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "NotAction": "iam:*",
      "Resource": "*"
    }
  ]
}

Note the use of NotAction to exclude IAM.

It's not quite the same as your policy (which can use CreateUser), but is a very efficient way to give somebody Power User permissions, without the ability to use IAM.

score 1 · Answer 2 · answered Dec 02 '16 at 15:13

1

Chance resource to

arn:aws:iam::1234

answered Dec 02 '16 at 15:13

Eltorrooo

157
2
15

Exclude Permissions from an Admin AWS Account?

Update

Update 2

2 Answers2