amazon-web-services - Restrict an IAM policy to run only in an specified account

Question

Can I impose a restriction on an IAM policy to run on a specific account only? I have searched for documentation or examples online but could not find anything on it.

Edited: There are multiple accounts and similar policies to implement, each with a different restriction. In such cases, to prevent any mixing up while implementation of policies; I want to ensure that there is a restriction that imposed on the policy that tells which AWS account this policy can live in.

CFT:

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Policy for XYZ'
Resources:
  XYZPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Description: "Restrictions apply only to Account XYZ"
      Path: "/"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Action:
              - "cloudformation:*"
              - "cloudtrail:*"
              - "cloudwatch:*"
              - "ec2:*"
              - "sso:*"
              - "s3:*"
            Resource: "*"
      Roles:
        -
            Ref: "XYZRole"
      ManagedPolicyName: "XYZPolicy

标签： amazon-web-servicesamazon-iam

Answer 1

默认情况下，一个策略只适用于它所属的账户，虽然你可以启用跨账户策略，所以你要做的基本上是默认的。

如果您真的想这样做，您可以尝试以下方法：

  "Condition": {
    "ArnEquals": {
      "iam:PolicyArn": [
        "arn:aws:iam::AWS-ACCOUNT-ID:policy/XYZPolicy"
      ]
    }
  }