amazon-web-servicesamazon-iam

Is it possible to have a "no-op" IAM policy?


What I have in mind in something like this:

{
    "Version": "2012-10-17",
    "Statement": []
}

But the policy editor rejects it for not containing any statements. I obviously understand why AWS enforces the condition that there must be a statement, so I'm more interested in answers explaining if/how to achieve a no-op statement than in answers explaining AWS's rationale here or asking why I want to do this.


Solution

  • I was able to create the following, I use in Terraform as a dummy policy when none is needed. Seems to work as long as AWS doesn't create an action of none:null

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "VisualEditor0",
                "Effect": "Allow",
                "Action": "none:null",
                "Resource": "*"
            }
        ]
    }