detach-policy¶

Description¶

Detaches a policy from a target root, organizational unit (OU), or account.

Warning

If the policy being detached is a service control policy (SCP), the changes to permissions for AWS Identity and Access Management (IAM) users and roles in affected accounts are immediate.

Every root, OU, and account must have at least one SCP attached. If you want to replace the default FullAWSAccess policy with an SCP that limits the permissions that can be delegated, you must attach the replacement SCP before you can remove the default SCP. This is the authorization strategy of an “allow list “. If you instead attach a second SCP and leave the FullAWSAccess SCP still attached, and specify "Effect": "Deny" in the second SCP to override the "Effect": "Allow" in the FullAWSAccess policy (or any other attached SCP), you’re using the authorization strategy of a “deny list “.

This operation can be called only from the organization’s management account.

Synopsis¶

  detach-policy
--policy-id <value>
--target-id <value>
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]

Options¶

--policy-id (string)

The unique identifier (ID) of the policy you want to detach. You can get the ID from the ListPolicies or ListPoliciesForTarget operations.

The regex pattern for a policy ID string requires “p-” followed by from 8 to 128 lowercase or uppercase letters, digits, or the underscore character (_).

--target-id (string)

The unique identifier (ID) of the root, OU, or account that you want to detach the policy from. You can get the ID from the ListRoots , ListOrganizationalUnitsForParent , or ListAccounts operations.

The regex pattern for a target ID string requires one of the following:

Root - A string that begins with “r-” followed by from 4 to 32 lowercase letters or digits.

Account - A string that consists of exactly 12 digits.

Organizational unit (OU) - A string that begins with “ou-” followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second “-” dash and from 8 to 32 additional lowercase letters or digits.

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command.

See ‘aws help’ for descriptions of global parameters.

Examples¶

To detach a policy from a root, OU, or account

The following example shows how to detach a policy from an OU:

aws organizations  detach-policy  --target-id ou-examplerootid111-exampleouid111 --policy-id p-examplepolicyid111

Output¶

None

Table of Contents

Feedback

User Guide