AWS：将用户添加到特定组的 IAM 策略

如何解决AWS：将用户添加到特定组的 IAM 策略

我正在尝试为组（“TheGroup”）设置策略，当附加到用户时，该策略将允许该用户创建新用户并将他们分配给另一个特定组（“TheSubGroup”）。

我相信我已经大部分完成了 createuser 部分，但我不确定如何在下面的策略的第二部分中还允许此用户 AddUserToGroup("TheSubGroup") 的语法。

有什么想法吗？

{
  "Version": "2012-10-17","Statement": [
    {
      "Sid": "ManageUsersPermissions","Effect": "Allow","Action": [
        "iam:ChangePasword","iam:CreateAccessKey","iam:CreateLoginProfile","iam:createuser","iam:DeleteAccessKey","iam:DeleteLoginProfile","iam:DeleteUser","iam:UpdateAccessKey","iam:ListAttachedUserPolicies","iam:ListPolicies","iam:ListUserPolicies","iam:ListGroups","iam:ListGroupsForUser","iam:GetPolicy","iam:GetAccountSummary"
      ],"Resource": "*"
    },{
      "Sid": "LimitedGroupAssignment","Action": [
        "iam:AddUserToGroup","iam:RemoveUserFromGroup"
      ],"Resource": "*","Condition": {
        "ArnEquals": {
          "iam:PolicyArn": [
            "arn:aws:iam::1234567890:group/TheSubGroup"
          ]
        }
      }
    }
  ]
}

解决方法

AddUserToGroup action applies to group resources。尝试定位群组资源：

{
  "Sid": "LimitedGroupAssignment","Effect": "Allow","Action": [
    "iam:AddUserToGroup","iam:RemoveUserFromGroup"
  ],"Resource": "arn:aws:iam::1234567890:group/TheSubGroup"
}