Merge pull request #16 from jplock/jp-update-assumed-root

[fix] prevent root actions
aws-samples · Feb 12, 2025 · 9746c50 · 9746c50
2 parents 5aafdc2 + aa74bce
commit 9746c50
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/template.yml b/template.yml
@@ -85,8 +85,10 @@ Resources:
             Action: "*"
             Resource: "*"
             Condition:
-              StringLike:
+              ArnLike:
                 "aws:PrincipalArn": !Sub "arn:${AWS::Partition}:iam::*:root"
+              "Null":
+                "aws:AssumedRoot": "true"
           - Sid: DenyLeaveOrganization
             Effect: Deny
             Action: "organizations:LeaveOrganization"