ds:UpdateNumberOfDomainControllers is a Write access-level action in the ds service. Grants permission to add or remove domain controllers to or from the directory. Based on the difference between current value and new value (provided through this API call), domain controllers will be added or removed. It may take up to 45 minutes for any new domain controllers to become fully active once the requested number of domain controllers is updated. During this time, you cannot make another update request
ARNs that ds:UpdateNumberOfDomainControllers can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants ds:UpdateNumberOfDomainControllers.
Filters access by the AWS DS Resource being acted upon
A minimal policy that allows ds:UpdateNumberOfDomainControllers. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowDsUpdateNumberOfDomainControllers",
"Effect": "Allow",
"Action": "ds:UpdateNumberOfDomainControllers",
"Resource": "*"
}
]
}