AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.
Container for the parameters to the DetachPolicy operation.
Detaches a policy from a target root, organizational unit (OU), or account.
If the policy being detached is a service control policy (SCP), the changes to permissions
for Identity and Access Management (IAM) users and roles in affected accounts are
immediate.
Every root, OU, and account must have at least one SCP attached. If you want to replace
the default FullAWSAccess
policy with an SCP that limits the permissions that
can be delegated, you must attach the replacement SCP before you can remove the default
SCP. This is the authorization strategy of an "allow
list". If you instead attach a second SCP and leave the FullAWSAccess
SCP
still attached, and specify "Effect": "Deny"
in the second SCP to override
the "Effect": "Allow"
in the FullAWSAccess
policy (or any other attached
SCP), you're using the authorization strategy of a "deny
list".
This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an Amazon Web Services service.
Namespace: Amazon.Organizations.Model
Assembly: AWSSDK.Organizations.dll
Version: 3.x.y.z
public class DetachPolicyRequest : AmazonOrganizationsRequest IAmazonWebServiceRequest
The DetachPolicyRequest type exposes the following members
Name | Description | |
---|---|---|
DetachPolicyRequest() |
Name | Type | Description | |
---|---|---|---|
PolicyId | System.String |
Gets and sets the property PolicyId. The unique identifier (ID) of the policy you want to detach. You can get the ID from the ListPolicies or ListPoliciesForTarget operations. The regex pattern for a policy ID string requires "p-" followed by from 8 to 128 lowercase or uppercase letters, digits, or the underscore character (_). |
|
TargetId | System.String |
Gets and sets the property TargetId. The unique identifier (ID) of the root, OU, or account that you want to detach the policy from. You can get the ID from the ListRoots, ListOrganizationalUnitsForParent, or ListAccounts operations. The regex pattern for a target ID string requires one of the following:
|
The following example shows how to detach a policy from an OU:/n/n
var client = new AmazonOrganizationsClient(); var response = client.DetachPolicy(new DetachPolicyRequest { PolicyId = "p-examplepolicyid111", TargetId = "ou-examplerootid111-exampleouid111" });
.NET Core App:
Supported in: 3.1
.NET Standard:
Supported in: 2.0
.NET Framework:
Supported in: 4.5, 4.0, 3.5