role-pb.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAllPermissionsExceptIAMUserOrRole",
            "Effect": "Allow",
            "NotAction": [
                "iam:CreateUser",
                "iam:AttachUserPolicy",
                "iam:PutUserPolicy",
                "iam:PutUserPermissionsBoundary",
                "iam:CreateRole",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:PutRolePermissionsBoundary",
                "iam:CreatePolicyVersion",
                "iam:DeletePolicy",
                "iam:DeletePolicyVersion",
                "iam:SetDefaultPolicyVersion",
                "iam:DeleteRolePermissionsBoundary",
                "iam:DeleteUserPermissionsBoundary"
            ],
            "Resource": "*"
        },
        {
            "Sid": "RequirePermissionsBoundaryForServiceAccounts",
            "Effect": "Allow",
            "Action": [
                "iam:CreateUser",
                "iam:AttachUserPolicy",
                "iam:PutUserPolicy",
                "iam:PutUserPermissionsBoundary"
            ],
            "Resource": "arn:aws:iam::123456789012:user/svc*",
            "Condition": {
                "StringEquals": {
                    "iam:PermissionsBoundary": "arn:aws:iam::123456789012:policy/serviceAccount-pb"
                }
            }
        },
        {
            "Sid": "RequirePermissionsBoundaryForUserAccounts",
            "Effect": "Allow",
            "Action": [
                "iam:CreateUser",
                "iam:AttachUserPolicy",
                "iam:PutUserPolicy",
                "iam:PutUserPermissionsBoundary"
            ],
            "NotResource": "arn:aws:iam::123456789012:user/svc*",
            "Condition": {
                "StringEquals": {
                    "iam:PermissionsBoundary": "arn:aws:iam::123456789012:policy/multiFactor-pb"
                }
            }
        },
        {
            "Sid": "RequirePermissionsBoundaryForRoles",
            "Effect": "Allow",
            "Action": [
                "iam:CreateRole",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:PutRolePermissionsBoundary"
            ],
            "Resource": "arn:aws:iam::123456789012:role/*",
            "Condition": {
                "StringEquals": {
                    "iam:PermissionsBoundary": "arn:aws:iam::123456789012:policy/role-pb"
                }
            }
        },
        {
            "Sid": "NoBoundaryPolicyEdit1",
            "Effect": "Deny",
            "Action": [
                "iam:CreatePolicyVersion",
                "iam:DeletePolicy",
                "iam:DeletePolicyVersion",
                "iam:SetDefaultPolicyVersion"
            ],
            "Resource": "arn:aws:iam::123456789012:policy/*-pb"
        },
        {
            "Sid": "NoBoundaryPolicyEdit2",
            "Effect": "Allow",
            "Action": [
                "iam:CreatePolicyVersion",
                "iam:DeletePolicy",
                "iam:DeletePolicyVersion",
                "iam:SetDefaultPolicyVersion"
            ],
            "NotResource": "arn:aws:iam::123456789012:policy/*-pb"
        },
        {
            "Sid": "NoBoundaryPermissionDelete",
            "Effect": "Deny",
            "Action": [
                "iam:DeleteRolePermissionsBoundary",
                "iam:DeleteUserPermissionsBoundary"
            ],
            "Resource": "*"
        }
    ]
}