{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RequireBoundaryOnRoleAndUserCreate",
      "Effect": "Deny",
      "Action": ["iam:CreateRole", "iam:CreateUser"],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": { "iam:PermissionsBoundary": "arn:aws:iam::396287094661:policy/external-dev-execution-boundary" },
        "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*", "arn:aws:iam::396287094661:role/githubdeploy-seahaven-external-dev-baseline"] }
      }
    },
    {
      "Sid": "ProtectBoundaryPolicyFromEdits",
      "Effect": "Deny",
      "Action": ["iam:CreatePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeletePolicy", "iam:DeletePolicyVersion"],
      "Resource": "arn:aws:iam::396287094661:policy/external-dev-execution-boundary"
    },
    {
      "Sid": "DenyAlteringPermissionsBoundaries",
      "Effect": "Deny",
      "Action": ["iam:DeleteRolePermissionsBoundary", "iam:DeleteUserPermissionsBoundary", "iam:PutRolePermissionsBoundary", "iam:PutUserPermissionsBoundary"],
      "Resource": "*",
      "Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*"] } }
    },
    {
      "Sid": "DenyIamUserAndAccessKeyCreation",
      "Effect": "Deny",
      "Action": ["iam:CreateUser", "iam:CreateAccessKey", "iam:CreateLoginProfile"],
      "Resource": "*",
      "Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole"] } }
    },
    {
      "Sid": "ProtectPrivilegedRoles",
      "Effect": "Deny",
      "Action": ["iam:UpdateAssumeRolePolicy", "iam:AttachRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePolicy", "iam:DeleteRolePolicy", "iam:DeleteRole", "iam:UpdateRole", "iam:TagRole", "iam:UntagRole"],
      "Resource": [
        "arn:aws:iam::396287094661:role/OrganizationAccountAccessRole",
        "arn:aws:iam::396287094661:role/cdk-hnb659fds-*",
        "arn:aws:iam::396287094661:role/githubdeploy-*",
        "arn:aws:iam::396287094661:role/seahaven-extdev-config-recorder-role",
        "arn:aws:iam::396287094661:role/seahaven-extdev-config-custom-resource-role",
        "arn:aws:iam::396287094661:role/aws-service-role/*"
      ],
      "Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*"] } }
    }
  ]
}