AWS SDK Version 3 for .NET
API Reference

AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.

Container for the parameters to the DetachPolicy operation. Detaches a policy from a target root, organizational unit (OU), or account. If the policy being detached is a service control policy (SCP), the changes to permissions for IAM users and roles in affected accounts are immediate.

Note: Every root, OU, and account must have at least one SCP attached. If you want to replace the default FullAWSAccess policy with one that limits the permissions that can be delegated, then you must attach the replacement policy before you can remove the default one. This is the authorization strategy of whitelisting. If you instead attach a second SCP and leave the FullAWSAccess SCP still attached, and specify "Effect": "Deny" in the second SCP to override the "Effect": "Allow" in the FullAWSAccess policy (or any other attached SCP), then you are using the authorization strategy of blacklisting.

This operation can be called only from the organization's master account.

Inheritance Hierarchy


Namespace: Amazon.Organizations.Model
Assembly: AWSSDK.Organizations.dll
Version: 3.x.y.z


public class DetachPolicyRequest : AmazonOrganizationsRequest

The DetachPolicyRequest type exposes the following members


Public Method DetachPolicyRequest()


Public Property PolicyId System.String

Gets and sets the property PolicyId.

The unique identifier (ID) of the policy you want to detach. You can get the ID from the ListPolicies or ListPoliciesForTarget operations.

The regex pattern for a policy ID string requires "p-" followed by from 8 to 128 lower-case letters or digits.

Public Property TargetId System.String

Gets and sets the property TargetId.

The unique identifier (ID) of the root, OU, or account from which you want to detach the policy. You can get the ID from the ListRoots, ListOrganizationalUnitsForParent, or ListAccounts operations.

The regex pattern for a target ID string requires one of the following:

  • Root: a string that begins with "r-" followed by from 4 to 32 lower-case letters or digits.

  • Account: a string that consists of exactly 12 digits.

  • Organizational unit (OU): a string that begins with "ou-" followed by from 4 to 32 lower-case letters or digits (the ID of the root that the OU is in) followed by a second "-" dash and from 8 to 32 additional lower-case letters or digits.


The following example shows how to detach a policy from an OU:/n/n

To detach a policy from a root, OU, or account

var response = client.DetachPolicy(new DetachPolicyRequest 
    PolicyId = "p-examplepolicyid111",
    TargetId = "ou-examplerootid111-exampleouid111"


Version Information

.NET Standard:
Supported in: 1.3

.NET Framework:
Supported in: 4.5, 4.0, 3.5

Portable Class Library:
Supported in: Windows Store Apps
Supported in: Windows Phone 8.1
Supported in: Xamarin Android
Supported in: Xamarin iOS (Unified)
Supported in: Xamarin.Forms