Search code examples
amazon-web-servicesamazon-iamaws-policiesaws-iam-policy

How to create an IAM user with full access except for admin


I want to add an IAM user to AWS with all permissions policies except for the ability to see billing and close account or change any information they don't need, that the root user has.

What policies should I add to this new group that the IAM user will be added to?


Solution

  • It would appear that no action is necessary.

    By default, IAM Users are not able to see billing. You would need to specifically allow them to see billing information. If this capability is set, you can still deny access by not giving (or by Denying) the aws-portal:ViewBilling permission.

    See: Using identity-based policies (IAM policies) for AWS Billing - AWS Billing

    It seems that AWS Account can only be closed by the root account (but I couldn't find anything that definitively states this).

    See: Close your AWS account

    If you are using AWS Organizations, it appears that the account closure must be performed from the management account (rather than the account itself): "When you sign in to the organization's management account, you can close member accounts that are part of your organization."