策略示例

示例1：禁止修改和删除IAM用户、IAM用户组、IRAM角色

{
“Version”: “2015-11-01”,
“Statement”: [
{
"
“Effect”: “Deny”,
“Action”: [
“iam:DeleteUser”,
“iam:ChangePassword”,
“iam:UpdateLoginProfile”,
“iam:DeleteGroup”,
“iam:RemoveUserFromGroup”,
“iam:UpdateGroup”,
“iam:DeleteRole”,
“iam:AttachRolePolicy”,
“iam:DetachRolePolicy”,
“iam:UpdateRoleTrustAccounts”,
“iam:AttachUserPolicy”,
“iam:DetachGroupPolicy”,
“iam:AttachGroupPolicy”,
“iam:CreateAccessKey”,
“iam:UpdateAccessKey”,
“iam:DeleteAccessKey”
],
“Resource”: “*”
}
]
}

禁止修改操作审计的投递地址、禁止关闭投递功能

{
“Version”: “2015-11-01”,
“Statement”: [
{

		"Effect": "Deny",
		"Action": [
			"actiontrail:DeleteTrail",
			"actiontrail:UpdateTrail",
			"actiontrail:StopTrail"
		],
		"Resource": "*",
		"Condition": []
	}
]

}