AWS IAM Policy allows all but specific IAM actions - amazon-web-services

Question

I'm trying to create a policy that allows users to have all IAM actions except any action contains the word "User" or "Group" in the string, so they can still do other actions like: "CreateRole", "ChangePassword", etc.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:*"
],
"Resource": "*",
"Condition": {
"StringNotLike": {
"iam": [
"*User*",
"*Group*"
]
}
}
}
]
}
But I got this notification: "This policy does not grant any permissions.". I've tried with "StringLike".
According to AWS Docs:
StringNotLike
Negated case-sensitive matching. The values can include a
multi-character match wildcard (*) or a single-character match
wildcard (?) anywhere in the string.
If I do this:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:*"
],
"Resource": "*"
},
{
"Effect": "Deny",
"Action": [
"iam:*User*",
"iam:*Group*"
],
"Resource": "*",
"Condition": {
"StringLike": {
"iam:": ["Create*", "Delete*"]
}
}
}
]
}
The the policy allows full access.

Answer 1

You can add a deny * action to your policy. It would deny everything that was not explicitly allowed.
Take a look at the bellow for an example.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"iam:AddRoleToInstanceProfile",
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:ListInstanceProfiles",
"iam:ListInstanceProfilesForRole",
"iam:ListRoles",
"iam:ListPolicies",
"iam:ListRolePolicies",
"iam:ListAttachedRolePolicies",
"iam:RemoveRoleFromInstanceProfile"
],
"Resource": [
"*"
],
"Effect": "Allow"
},
"Resource": [
"*"
],
"Effect": "Deny"
}
]
}

Answer 2

I had to do explicit deny like this. It works but I'm open to better solution.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:*"
],
"Resource": "*"
},
{
"Effect": "Deny",
"Action": [
"iam:CreateGroup",
"iam:DeleteGroup",
"iam:UpdateUser",
"iam:PutUserPermissionsBoundary",
"iam:AttachUserPolicy",
"iam:DeleteUserPolicy",
"iam:UpdateGroup",
"iam:DeleteUser",
"iam:DeleteUserPermissionsBoundary",
"iam:CreateUser",
"iam:RemoveUserFromGroup",
"iam:AddUserToGroup",
"iam:AttachGroupPolicy",
"iam:PutUserPolicy",
"iam:DetachGroupPolicy",
"iam:DetachUserPolicy",
"iam:DeleteGroupPolicy",
"iam:PutGroupPolicy"
],
"Resource": "*"
}
]
}