ds:CreateDirectory is a Write access-level action in the ds service. Grants permission to create a Simple AD directory
This action does not support resource-level permissions; use "Resource": "*" in your policy.
Keys you can use in the Condition block of a policy that grants ds:CreateDirectory.
Filters access by the value of the request to AWS DS
Filters access by the AWS DS Resource being acted upon
Filters access by the tag keys that are passed in the request
A minimal policy that allows ds:CreateDirectory. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowDsCreateDirectory",
"Effect": "Allow",
"Action": "ds:CreateDirectory",
"Resource": "*"
}
]
}