Detaches a policy from a target root, organizational unit (OU), or account. If the policy being detached is a service control policy (SCP), the changes to permissions for IAM users and roles in affected accounts are immediate.
organizations_detach_policy(PolicyId, TargetId)[required] The unique identifier (ID) of the policy you want to detach. You can get the ID from the ListPolicies or ListPoliciesForTarget operations.
The regex pattern for a policy ID string requires "p-" followed by from 8 to 128 lower-case letters or digits.
[required] The unique identifier (ID) of the root, OU, or account that you want to detach the policy from. You can get the ID from the ListRoots, ListOrganizationalUnitsForParent, or ListAccounts operations.
The regex pattern for a target ID string requires one of the following:
Root: a string that begins with "r-" followed by from 4 to 32 lower-case letters or digits.
Account: a string that consists of exactly 12 digits.
Organizational unit (OU): a string that begins with "ou-" followed by from 4 to 32 lower-case letters or digits (the ID of the root that the OU is in) followed by a second "-" dash and from 8 to 32 additional lower-case letters or digits.
svc$detach_policy( PolicyId = "string", TargetId = "string" )
Note: Every root, OU, and account must have at least one SCP
attached. If you want to replace the default FullAWSAccess policy with
one that limits the permissions that can be delegated, you must attach
the replacement policy before you can remove the default one. This is
the authorization strategy of
whitelisting.
If you instead attach a second SCP and leave the FullAWSAccess SCP
still attached, and specify "Effect": "Deny" in the second SCP to
override the "Effect": "Allow" in the FullAWSAccess policy (or any
other attached SCP), you're using the authorization strategy of
blacklisting.
This operation can be called only from the organization's master account.
# NOT RUN {
# The following example shows how to detach a policy from an OU:/n/n
# }
# NOT RUN {
svc$detach_policy(
PolicyId = "p-examplepolicyid111",
TargetId = "ou-examplerootid111-exampleouid111"
)
# }
# NOT RUN {
# }
Run the code above in your browser using DataLab