Detaches a policy from a target root, organizational unit (OU), or account.
If the policy being detached is a service control policy (SCP), the changes to permissions for AWS Identity and Access Management (IAM) users and roles in affected accounts are immediate.
Every root, OU, and account must have at least one SCP attached. If you
want to replace the default
FullAWSAccess policy with an SCP that
limits the permissions that can be delegated, you must attach the
replacement SCP before you can remove the default SCP. This is the
authorization strategy of an "allow list".
If you instead attach a second SCP and leave the
still attached, and specify
"Effect": "Deny" in the second SCP to
"Effect": "Allow" in the
FullAWSAccess policy (or any
other attached SCP), you're using the authorization strategy of a "deny list".
This operation can be called only from the organization's management account.
[required] The unique identifier (ID) of the policy you want to detach. You can get
the ID from the
The regex pattern for a policy ID string requires "p-" followed by from 8 to 128 lowercase or uppercase letters, digits, or the underscore character (_).
[required] The unique identifier (ID) of the root, OU, or account that you want to
detach the policy from. You can get the ID from the
The regex pattern for a target ID string requires one of the following:
An empty list.
1 2 3 4
svc$detach_policy( PolicyId = "string", TargetId = "string" )
1 2 3 4 5 6 7 8
## Not run: # The following example shows how to detach a policy from an OU:/n/n svc$detach_policy( PolicyId = "p-examplepolicyid111", TargetId = "ou-examplerootid111-exampleouid111" ) ## End(Not run)
Add the following code to your website.
For more information on customizing the embed code, read Embedding Snippets.