shield:DisassociateDRTLogBucket is a Write access-level action in the shield service. Grants permission to remove the DDoS Response team's access to the specified Amazon S3 bucket containing your flow logs
This action does not support resource-level permissions; use "Resource": "*" in your policy.
No condition keys are documented for this action.
A minimal policy that allows shield:DisassociateDRTLogBucket. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowShieldDisassociateDRTLogBucket",
"Effect": "Allow",
"Action": "shield:DisassociateDRTLogBucket",
"Resource": "*"
}
]
}