ec2:DisableIpamOrganizationAdminAccount is a Write access-level action in the ec2 service. Grants permission to disable an AWS Organizations member account as an Amazon VPC IP Address Manager (IPAM) admin account
This action does not support resource-level permissions; use "Resource": "*" in your policy.
Keys you can use in the Condition block of a policy that grants ec2:DisableIpamOrganizationAdminAccount.
Filters access by the name of the AWS Region
A minimal policy that allows ec2:DisableIpamOrganizationAdminAccount. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowEc2DisableIpamOrganizationAdminAccount",
"Effect": "Allow",
"Action": "ec2:DisableIpamOrganizationAdminAccount",
"Resource": "*"
}
]
}