Detaches a policy from a target root, organizational unit (OU), or account.
If the policy being detached is a service control policy (SCP), the changes to
permissions for Identity and Access Management (IAM) users and roles in affected accounts are
immediate.
Every root, OU, and account must have at least one SCP attached. If you want to
replace the default FullAWSAccess policy with an SCP that limits the
permissions that can be delegated, you must attach the replacement SCP before you can
remove the default SCP. This is the authorization strategy of an "allow list". If you instead attach a second SCP and
leave the FullAWSAccess SCP still attached, and specify "Effect":
"Deny" in the second SCP to override the "Effect": "Allow" in
the FullAWSAccess policy (or any other attached SCP), you're using the
authorization strategy of a "deny list".
This operation can be called only from the organization's management account.
example
Use a bare-bones client and the command you need to make an API call.
Detaches a policy from a target root, organizational unit (OU), or account.
If the policy being detached is a service control policy (SCP), the changes to permissions for Identity and Access Management (IAM) users and roles in affected accounts are immediate.
Every root, OU, and account must have at least one SCP attached. If you want to replace the default
FullAWSAccesspolicy with an SCP that limits the permissions that can be delegated, you must attach the replacement SCP before you can remove the default SCP. This is the authorization strategy of an "allow list". If you instead attach a second SCP and leave theFullAWSAccessSCP still attached, and specify"Effect": "Deny"in the second SCP to override the"Effect": "Allow"in theFullAWSAccesspolicy (or any other attached SCP), you're using the authorization strategy of a "deny list".This operation can be called only from the organization's management account.
Use a bare-bones client and the command you need to make an API call.
import { OrganizationsClient, DetachPolicyCommand } from "@aws-sdk/client-organizations"; // ES Modules import // const { OrganizationsClient, DetachPolicyCommand } = require("@aws-sdk/client-organizations"); // CommonJS import const client = new OrganizationsClient(config); const command = new DetachPolicyCommand(input); const response = await client.send(command);DetachPolicyCommandInput for command's
inputshape.DetachPolicyCommandOutput for command's
responseshape.config for OrganizationsClient's
configshape.