IAM policies should not use 'Effect: Allow' with 'NotAction'
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Description
IAM policies using ‘Effect: Allow’ with ‘NotAction’ permits all actions except those explicitly denied, which can lead to unintended privilege escalation and broader access than intended. Instead, explicit permissions should be defined to enforce the principle of least privilege, ensuring users have only the access necessary for their roles.
From the console
See the IAM JSON Policy Elements: NotAction documentation for guidance on how to modify policies. Replace ‘NotAction’ with specific actions that should be allowed and ensure your policies adhere to the principle of least privilege.
