ds-data:ListGroupMembers is a List access-level action in the ds-data service. Grants permission to list members in a group on a directory
ARNs that ds-data:ListGroupMembers can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants ds-data:ListGroupMembers.
Filters access by the type of identifier provided in the request (i.e. SAM Account Name)
Filters access by the directory realm name included in the MemberRealm input of the request
Filters access by the directory realm name for the request
Filters access by the directory SAM Account Name included in the SAMAccountName input of the request
Filters access by the AWS DS Resource being acted upon
A minimal policy that allows ds-data:ListGroupMembers. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowDsdataListGroupMembers",
"Effect": "Allow",
"Action": "ds-data:ListGroupMembers",
"Resource": "*"
}
]
}