AWS SCP Condition disallow iam user creation

Question

I am trying to create an SCP policy to disallow creation of iam user in member accounts other than Admin (assumed role with SSO), however its not letting even the admin create the user, below is the policy I am using,

  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1",
      "Effect": "Deny",
      "Action": [
        "iam:CreateUser",
        "iam:CreateAccessKey",
        "iam:DeleteAccessKey",
        "iam:DeleteUser"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringNotLike": {
          "aws:PrincipalArn": [
            "arn:aws:sts::*:assumed-role/AWSReservedSSO_AWSAdministratorAccess*/*"
          ]
        }
      }
    }
  ]
}

Not sure what's wrong in it, please help

Answer 1

The PrincipalArn should be:

arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWSAdministratorAccess*

To get an valid ARN for SSO assumed roles, you need to change arn:aws:sts::*:assumed-role by arn:aws:iam::*:role.

Additionally, this represents the SSO group, so you do not need to add /* after the group name. So the following ARN is incorrect and will not work:

arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWSAdministratorAccess/*

---

Reference:

Implement service control policy (SCP) for accounts in AWS Organizations