ds:RemoveRegion

Write

ds:RemoveRegion is a Write access-level action in the ds service. Grants permission to stop all replication and removes the domain controllers from the specified Region. You cannot remove the primary Region with this operation

Resource types

ARNs that ds:RemoveRegion can be scoped to in an IAM policy.

arn:${Partition}:ds:${Region}:${Account}:directory/${DirectoryId}

Condition keys

Keys you can use in the Condition block of a policy that grants ds:RemoveRegion.

aws:ResourceTag/${TagKey} String

Filters access by the AWS DS Resource being acted upon

Example IAM policy

A minimal policy that allows ds:RemoveRegion. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowDsRemoveRegion",
      "Effect": "Allow",
      "Action": "ds:RemoveRegion",
      "Resource": "*"
    }
  ]
}

Related actions in ds

ds:AcceptSharedDirectory Write ds:AccessDSData Permissions management ds:AddIpRoutes Write ds:AddRegion Write ds:AddTagsToResource Tagging ds:AuthorizeApplication Write ds:CancelSchemaExtension Write ds:CheckAlias Read ds:ConnectDirectory Write ds:CreateAlias Write ds:CreateComputer Write ds:CreateConditionalForwarder Write

View all ds actions →