無法將AWS策略應用於組，僅限於用戶

Question

我正嘗試在CloudSearch域上設置權限。

這一政策的工作原理：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Effect": "Allow", 
     "Principal": { 
     "AWS": "arn:aws:iam::55555555:user/SearchUser" 
     }, 
     "Action": "cloudsearch:*" 
    } 
    ] 
} 

這不：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Effect": "Allow", 
     "Principal": { 
     "AWS": "arn:aws:iam::55555555:group/SearchGroup" 
     }, 
     "Action": "cloudsearch:*" 
    } 
    ] 
} 

唯一的區別是用戶/ SearchUser對組/ SearchGroup

當我嘗試申請後者只是給我一個錯誤：

Error setting policy: [{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::55555555:group/SearchGroup"},"Action":"cloudsearch:*"}]}]

關於爲什麼政策適用於用戶而不是羣組的任何想法？

Answer 1

組不支持。

Specifying a Principal

You specify a principal using the Amazon Resource Name (ARN) of the AWS account, IAM user, IAM role, federated user, or assumed-role user. You cannot specify IAM groups as principals.

http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Principal