授予用戶創建組織權限的 SLR 策略

Question

我想要一個能夠創建 IAM 組織的 IAM 用戶，僅此而已。

為此，我需要創建一個使用 SLR 的策略。

我將策略附加到我的 IAM 所屬的組。

如果我使用一般的 SLR 權限策略，我可以創建一個包含任何用戶的組織。

{
    "Effect": "Allow",
    "Action": "iam:CreateServiceLinkedRole",
    "Resource": "arn:aws:iam::*:role/aws-service-role/*"
}

當我指定我想要擁有這些權限的確切用戶資源時，我不能再這樣做了。

這是 aws 文檔中提供的模板

{
   "Effect": "Allow",
   "Action": "iam:CreateServiceLinkedRole",
   "Resource": "arn:aws:iam::*:role/aws-service-role/SERVICE-NAME.amazonaws.com/SERVICE-LINKED-ROLE-NAME-PREFIX*",
   "Condition": {"StringLike": {"iam:AWSServiceName": "SERVICE-NAME.amazonaws.com"}}
},

這是我的

{
  "Effect": "Allow",
  "Action": "iam:CreateServiceLinkedRole",
  "Resource": "arn:aws:iam::000056397000:user/root_name:role/aws-service-role/organizations.amazonaws.com/*"
}

我得到的錯誤是：

An error occurred (AccessDeniedForDependencyException) when calling the CreateOrganization operation: The

request failed because your credentials do not have permission to create the service-linked role required 

by AWS Organizations.

我錯過了什么？

Answer 1

我找到了解決方法。 不理想，也許有人有更好的主意。

包含 2 個策略的組

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": "arn:aws:iam::*:role/aws-service-role/organizations.amazonaws.com/AWSServiceRoleForOrganizations*",
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "organizations.amazonaws.com"
                }
            }
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "organizations:CreateOrganization",
            "Resource": "*"
        }
    ]
}