ds-data:AddGroupMember is a Write access-level action in the ds-data service. Grants permission to add a member to a group on a directory
ARNs that ds-data:AddGroupMember can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants ds-data:AddGroupMember.
Filters access by the type of identifier provided in the request (i.e. SAM Account Name)
Filters access by the directory SAM Account Name included in the MemberName input of the request
Filters access by the directory realm name included in the MemberRealm input of the request
Filters access by the directory realm name for the request
Filters access by the directory SAM Account Name included in the SAMAccountName input of the request
Filters access by the AWS DS Resource being acted upon
A minimal policy that allows ds-data:AddGroupMember. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowDsdataAddGroupMember",
"Effect": "Allow",
"Action": "ds-data:AddGroupMember",
"Resource": "*"
}
]
}