ds:DeleteTrust

Write

ds:DeleteTrust is a Write access-level action in the ds service. Grants permission to delete an existing trust relationship between your Microsoft AD in the AWS cloud and an external domain

Resource types

ARNs that ds:DeleteTrust can be scoped to in an IAM policy.

arn:${Partition}:ds:${Region}:${Account}:directory/${DirectoryId}
directory

Condition keys

Keys you can use in the Condition block of a policy that grants ds:DeleteTrust.

aws:ResourceTag/${TagKey} String

Filters access by the AWS DS Resource being acted upon

Example IAM policy

A minimal policy that allows ds:DeleteTrust. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowDsDeleteTrust",
      "Effect": "Allow",
      "Action": "ds:DeleteTrust",
      "Resource": "*"
    }
  ]
}

Related actions in ds

ds:AcceptSharedDirectory Write ds:AccessDSData Permissions management ds:AddIpRoutes Write ds:AddRegion Write ds:AddTagsToResource Tagging ds:AuthorizeApplication Write ds:CancelSchemaExtension Write ds:CheckAlias Read ds:ConnectDirectory Write ds:CreateAlias Write ds:CreateComputer Write ds:CreateConditionalForwarder Write

View all ds actions →