This config worked for users with org SSO logins. Account #, cloud sso & IAMUserAccessKey: are masked:
regions:
- global
- us-east-1
- us-east-2
- us-west-1
- us-west-2
account-blocklist:
presets:
iam-protect:
filters:
IAMSAMLProvider:
- "cloudsso.org.com"
IAMRole:
- "admin"
- "devops"
- "OrganizationAccountAccessRole"
- "AWSServiceRoleForOrganizations"
IAMPolicy:
- property: Name
value: "AdministratorAccess"
- property: Name
value: "PowerUserAccess"
IAMUser:
- "admin"
IAMUserAccessKey:
- "admin -> ZZZZZZZZZZZZZZZZZZZZ"
IAMUserPolicyAttachment:
- "admin -> AdministratorAccess"
IAMRolePolicyAttachment:
- property: RoleName
value: "admin"
- property: RoleName
value: "devops"
- property: RoleName
value: "OrganizationAccountAccessRole"
accounts:
"999999999999":
presets:
- iam-protect
This config worked for users with org SSO logins. Account #, cloud sso & IAMUserAccessKey: are masked:
regions:
account-blocklist:
presets:
iam-protect:
filters:
IAMSAMLProvider:
- "cloudsso.org.com"
accounts:
"999999999999":
presets:
- iam-protect