-
Notifications
You must be signed in to change notification settings - Fork 495
Closed
Labels
Description
Expected Behavior
User with "admin:ListUser" policy but no "admin:CreateUser" policy should be able to view ListUsers screen with Create User button disabled.
Current Behavior
User with "admin:ListUser" policy but no "admin:AddUser" policy has enabled Create User button on ListUsers screen, can access AddUserScreen and attempt to add a User - prompting access denied error.
Steps to Reproduce (for bugs)
- Create the following policy and apply it to a User
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"admin:ListGroups",
"admin:ListUserPolicies",
"admin:ListUsers",
"admin:AttachUserOrGroupPolicy",
"admin:GetUser"
],
"Resource": [
"arn:aws:s3:::*"
]
}
]
}
- Log in as the above User and navigate to List Users screen by clicking Identity>Users in menu
- Observe Create User button is enabled
- Click Create User Button to navigate to Add User screen and try to create a User
- Observe "Access Denied." error
Context
admin:CreateUser permission added to session for all users logged into Console