[fix] prevent root actions

aws-samples · Feb 12, 2025 · aa74bce · aa74bce
1 parent 5aafdc2
commit aa74bce
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/template.yml b/template.yml
@@ -85,8 +85,10 @@ Resources:
             Action: "*"
             Resource: "*"
             Condition:
-              StringLike:
+              ArnLike:
                 "aws:PrincipalArn": !Sub "arn:${AWS::Partition}:iam::*:root"
+              "Null":
+                "aws:AssumedRoot": "true"
           - Sid: DenyLeaveOrganization
             Effect: Deny
             Action: "organizations:LeaveOrganization"