amazonka-organizations-1.5.0: Amazon Organizations SDK.

Copyright(c) 2013-2017 Brendan Hay
LicenseMozilla Public License, v. 2.0.
MaintainerBrendan Hay <brendan.g.hay+amazonka@gmail.com>
Stabilityauto-generated
Portabilitynon-portable (GHC extensions)
Safe HaskellNone
LanguageHaskell2010

Network.AWS.Organizations.DetachPolicy

Contents

Description

Detaches a policy from a target root, organizational unit, or account. If the policy being detached is a service control policy (SCP), the changes to permissions for IAM users and roles in affected accounts are immediate.

Note: Every root, OU, and account must have at least one SCP attached. If you want to replace the default FullAWSAccess policy with one that limits the permissions that can be delegated, then you must attach the replacement policy before you can remove the default one. This is the authorization strategy of whitelisting . If you instead attach a second SCP and leave the FullAWSAccess SCP still attached, and specify Effect: Deny in the second SCP to override the Effect: Allow in the FullAWSAccess policy (or any other attached SCP), then you are using the authorization strategy of blacklisting .

This operation can be called only from the organization's master account.

Synopsis

Creating a Request

detachPolicy Source #

Creates a value of DetachPolicy with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

  • detPolicyId - The unique identifier (ID) of the policy you want to detach. You can get the ID from the ListPolicies or ListPoliciesForTarget operations. The regex pattern for a policy ID string requires "p-" followed by from 8 to 128 lower-case letters or digits.
  • detTargetId - The unique identifier (ID) of the root, OU, or account from which you want to detach the policy. You can get the ID from the ListRoots , ListOrganizationalUnitsForParent , or ListAccounts operations. The regex pattern for a target ID string requires one of the following: * Root: a string that begins with "r-" followed by from 4 to 32 lower-case letters or digits. * Account: a string that consists of exactly 12 digits. * Organizational unit (OU): a string that begins with "ou-" followed by from 4 to 32 lower-case letters or digits (the ID of the root that the OU is in) followed by a second "-" dash and from 8 to 32 additional lower-case letters or digits.

data DetachPolicy Source #

See: detachPolicy smart constructor.

Instances

Eq DetachPolicy Source # 
Data DetachPolicy Source # 

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> DetachPolicy -> c DetachPolicy #

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c DetachPolicy #

toConstr :: DetachPolicy -> Constr #

dataTypeOf :: DetachPolicy -> DataType #

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c DetachPolicy) #

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c DetachPolicy) #

gmapT :: (forall b. Data b => b -> b) -> DetachPolicy -> DetachPolicy #

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> DetachPolicy -> r #

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> DetachPolicy -> r #

gmapQ :: (forall d. Data d => d -> u) -> DetachPolicy -> [u] #

gmapQi :: Int -> (forall d. Data d => d -> u) -> DetachPolicy -> u #

gmapM :: Monad m => (forall d. Data d => d -> m d) -> DetachPolicy -> m DetachPolicy #

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> DetachPolicy -> m DetachPolicy #

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> DetachPolicy -> m DetachPolicy #

Read DetachPolicy Source # 
Show DetachPolicy Source # 
Generic DetachPolicy Source # 

Associated Types

type Rep DetachPolicy :: * -> * #

Hashable DetachPolicy Source # 
ToJSON DetachPolicy Source # 
NFData DetachPolicy Source # 

Methods

rnf :: DetachPolicy -> () #

AWSRequest DetachPolicy Source # 
ToQuery DetachPolicy Source # 
ToPath DetachPolicy Source # 
ToHeaders DetachPolicy Source # 
type Rep DetachPolicy Source # 
type Rep DetachPolicy = D1 (MetaData "DetachPolicy" "Network.AWS.Organizations.DetachPolicy" "amazonka-organizations-1.5.0-9d9i18lsT75IlwObP60hiK" False) (C1 (MetaCons "DetachPolicy'" PrefixI True) ((:*:) (S1 (MetaSel (Just Symbol "_detPolicyId") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)) (S1 (MetaSel (Just Symbol "_detTargetId") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text))))
type Rs DetachPolicy Source # 

Request Lenses

detPolicyId :: Lens' DetachPolicy Text Source #

The unique identifier (ID) of the policy you want to detach. You can get the ID from the ListPolicies or ListPoliciesForTarget operations. The regex pattern for a policy ID string requires "p-" followed by from 8 to 128 lower-case letters or digits.

detTargetId :: Lens' DetachPolicy Text Source #

The unique identifier (ID) of the root, OU, or account from which you want to detach the policy. You can get the ID from the ListRoots , ListOrganizationalUnitsForParent , or ListAccounts operations. The regex pattern for a target ID string requires one of the following: * Root: a string that begins with "r-" followed by from 4 to 32 lower-case letters or digits. * Account: a string that consists of exactly 12 digits. * Organizational unit (OU): a string that begins with "ou-" followed by from 4 to 32 lower-case letters or digits (the ID of the root that the OU is in) followed by a second "-" dash and from 8 to 32 additional lower-case letters or digits.

Destructuring the Response

detachPolicyResponse :: DetachPolicyResponse Source #

Creates a value of DetachPolicyResponse with the minimum fields required to make a request.

data DetachPolicyResponse Source #

See: detachPolicyResponse smart constructor.

Instances

Eq DetachPolicyResponse Source # 
Data DetachPolicyResponse Source # 

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> DetachPolicyResponse -> c DetachPolicyResponse #

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c DetachPolicyResponse #

toConstr :: DetachPolicyResponse -> Constr #

dataTypeOf :: DetachPolicyResponse -> DataType #

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c DetachPolicyResponse) #

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c DetachPolicyResponse) #

gmapT :: (forall b. Data b => b -> b) -> DetachPolicyResponse -> DetachPolicyResponse #

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> DetachPolicyResponse -> r #

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> DetachPolicyResponse -> r #

gmapQ :: (forall d. Data d => d -> u) -> DetachPolicyResponse -> [u] #

gmapQi :: Int -> (forall d. Data d => d -> u) -> DetachPolicyResponse -> u #

gmapM :: Monad m => (forall d. Data d => d -> m d) -> DetachPolicyResponse -> m DetachPolicyResponse #

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> DetachPolicyResponse -> m DetachPolicyResponse #

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> DetachPolicyResponse -> m DetachPolicyResponse #

Read DetachPolicyResponse Source # 
Show DetachPolicyResponse Source # 
Generic DetachPolicyResponse Source # 
NFData DetachPolicyResponse Source # 

Methods

rnf :: DetachPolicyResponse -> () #

type Rep DetachPolicyResponse Source # 
type Rep DetachPolicyResponse = D1 (MetaData "DetachPolicyResponse" "Network.AWS.Organizations.DetachPolicy" "amazonka-organizations-1.5.0-9d9i18lsT75IlwObP60hiK" False) (C1 (MetaCons "DetachPolicyResponse'" PrefixI False) U1)