import type { MetadataBearer as __MetadataBearer } from "@smithy/types"; import type { DetachPolicyRequest } from "../models/models_0"; /** * @public */ export type { __MetadataBearer }; /** * @public * * The input for {@link DetachPolicyCommand}. */ export interface DetachPolicyCommandInput extends DetachPolicyRequest { } /** * @public * * The output of {@link DetachPolicyCommand}. */ export interface DetachPolicyCommandOutput extends __MetadataBearer { } declare const DetachPolicyCommand_base: { new (input: DetachPolicyCommandInput): import("@smithy/core/client").CommandImpl; new (input: DetachPolicyCommandInput): import("@smithy/core/client").CommandImpl; getEndpointParameterInstructions(): import("@smithy/types").EndpointParameterInstructions; }; /** *

Detaches a policy from a target root, organizational unit (OU), or account.

* *

If the policy being detached is a service control policy (SCP), the changes to * permissions for Identity and Access Management (IAM) users and roles in affected accounts are * immediate.

* *

Every root, OU, and account must have at least one SCP attached. If you want to * replace the default FullAWSAccess policy with an SCP that limits the * permissions that can be delegated, you must attach the replacement SCP before you can * remove the default SCP. This is the authorization strategy of an "allow list". If you instead attach a second SCP and * leave the FullAWSAccess SCP still attached, and specify "Effect": * "Deny" in the second SCP to override the "Effect": "Allow" in * the FullAWSAccess policy (or any other attached SCP), you're using the * authorization strategy of a "deny list".

You can only call this operation from the management account or a member account that is a delegated administrator.

* @example * Use a bare-bones client and the command you need to make an API call. * ```javascript * import { OrganizationsClient, DetachPolicyCommand } from "@aws-sdk/client-organizations"; // ES Modules import * // const { OrganizationsClient, DetachPolicyCommand } = require("@aws-sdk/client-organizations"); // CommonJS import * // import type { OrganizationsClientConfig } from "@aws-sdk/client-organizations"; * const config = {}; // type is OrganizationsClientConfig * const client = new OrganizationsClient(config); * const input = { // DetachPolicyRequest * PolicyId: "STRING_VALUE", // required * TargetId: "STRING_VALUE", // required * }; * const command = new DetachPolicyCommand(input); * const response = await client.send(command); * // {}; * * ``` * * @param DetachPolicyCommandInput - {@link DetachPolicyCommandInput} * @returns {@link DetachPolicyCommandOutput} * @see {@link DetachPolicyCommandInput} for command's `input` shape. * @see {@link DetachPolicyCommandOutput} for command's `response` shape. * @see {@link OrganizationsClientResolvedConfig | config} for OrganizationsClient's `config` shape. * * @throws {@link AccessDeniedException} (client fault) *

You don't have permissions to perform the requested operation. The user or role that * is making the request must have at least one IAM permissions policy attached that * grants the required permissions. For more information, see Access Management in the * IAM User Guide.

* * @throws {@link AWSOrganizationsNotInUseException} (client fault) *

Your account isn't a member of an organization. To make this request, you must use the * credentials of an account that belongs to an organization.

* * @throws {@link ConcurrentModificationException} (client fault) *

The target of the operation is currently being modified by a different request. Try * again later.

* * @throws {@link ConstraintViolationException} (client fault) *

Performing this operation violates a minimum or maximum value limit. For example, * attempting to remove the last service control policy (SCP) from an OU or root, inviting * or creating too many accounts to the organization, or attaching too many policies to an * account, OU, or root. This exception includes a reason that contains additional * information about the violated limit:

* *

Some of the reasons in the following list might not be applicable to this specific * API or operation.

* *

*
ACCOUNT_CANNOT_LEAVE_ORGANIZATION: You attempted to remove the management * account from the organization. You can't remove the management account. Instead, * after you remove all member accounts, delete the organization itself.
*
*
ACCOUNT_CANNOT_LEAVE_WITHOUT_PHONE_VERIFICATION: You attempted to remove an * account from the organization that doesn't yet have enough information to exist * as a standalone account. This account requires you to first complete phone * verification. Follow the steps at Removing a member account from your organization in the * Organizations User Guide.
*
*
ACCOUNT_CREATION_RATE_LIMIT_EXCEEDED: You attempted to exceed the number of * accounts that can be in progress at a time.
*
*
ACCOUNT_CREATION_NOT_COMPLETE: Your account setup isn't complete or your * account isn't fully active. You must complete the account setup before you * create an organization.
*
*
ACCOUNT_NOT_ACTIVE_FOR_TRANSFER_RESPONSIBILITY: Your account setup isn't * complete or your account isn't fully active to invite or accept a Billing * Transfer invitation.
*
*
ACTIVE_RESPONSIBILITY_TRANSFER_PROCESS: You cannot delete organization due to an ongoing responsibility transfer process. For example, a pending invitation or an in-progress transfer. To delete the organization, you must resolve the current transfer process.
*
*
ACCOUNT_NUMBER_LIMIT_EXCEEDED: You attempted to exceed the limit on the number * of accounts in an organization. If you need more accounts, contact Amazon Web Services Support to * request an increase in your limit.
*
Or the number of invitations that you tried to send would cause you to exceed * the limit of accounts in your organization. Send fewer invitations or contact * Amazon Web Services Support to request an increase in the number of accounts.
* *
Deleted and closed accounts still count toward your limit.
* * *
If you get this exception when running a command immediately after * creating the organization, wait one hour and try again. After an hour, if * the command continues to fail with this error, contact Amazon Web Services Support.
* *
*
ALL_FEATURES_MIGRATION_ORGANIZATION_SIZE_LIMIT_EXCEEDED: Your organization has * more than 5000 accounts, and you can only use the standard migration process for * organizations with less than 5000 accounts. Use the assisted migration process * to enable all features mode, or create a support case for assistance if you are * unable to use assisted migration.
*
*
CANNOT_REGISTER_SUSPENDED_ACCOUNT_AS_DELEGATED_ADMINISTRATOR: You cannot * register a suspended account as a delegated administrator.
*
*
CANNOT_REGISTER_MASTER_AS_DELEGATED_ADMINISTRATOR: You attempted to register * the management account of the organization as a delegated administrator for an * Amazon Web Services service integrated with Organizations. You can designate only a member account as a * delegated administrator.
*
*
CANNOT_CLOSE_MANAGEMENT_ACCOUNT: You attempted to close the management * account. To close the management account for the organization, you must first * either remove or close all member accounts in the organization. Follow standard * account closure process using root credentials.
*
*
CANNOT_REMOVE_DELEGATED_ADMINISTRATOR_FROM_ORG: You attempted to remove an * account that is registered as a delegated administrator for a service integrated * with your organization. To complete this operation, you must first deregister * this account as a delegated administrator.
*
*
CLOSE_ACCOUNT_QUOTA_EXCEEDED: You have exceeded close account quota for the * past 30 days.
*
*
CLOSE_ACCOUNT_REQUESTS_LIMIT_EXCEEDED: You attempted to exceed the number of * accounts that you can close at a time.
*
*
CREATE_ORGANIZATION_IN_BILLING_MODE_UNSUPPORTED_REGION: To create an * organization in the specified region, you must enable all features mode.
*
*
DELEGATED_ADMINISTRATOR_EXISTS_FOR_THIS_SERVICE: You attempted to register an * Amazon Web Services account as a delegated administrator for an Amazon Web Services service that already has * a delegated administrator. To complete this operation, you must first deregister * any existing delegated administrators for this service.
*
*
EMAIL_VERIFICATION_CODE_EXPIRED: The email verification code is only valid for * a limited period of time. You must resubmit the request and generate a new * verification code.
*
*
HANDSHAKE_RATE_LIMIT_EXCEEDED: You attempted to exceed the number of * handshakes that you can send in one day.
*
*
INVALID_PAYMENT_INSTRUMENT: You cannot remove an account because no supported * payment method is associated with the account. Amazon Web Services does not support cards * issued by financial institutions in Russia or Belarus. For more information, see * Managing your * Amazon Web Services payments.
*
*
MASTER_ACCOUNT_ADDRESS_DOES_NOT_MATCH_MARKETPLACE: To create an account in * this organization, you first must migrate the organization's management account * to the marketplace that corresponds to the management account's address. All * accounts in an organization must be associated with the same marketplace.
*
*
MASTER_ACCOUNT_MISSING_BUSINESS_LICENSE: Applies only to the Amazon Web Services Regions in * China. To create an organization, the master must have a valid business license. * For more information, contact customer support.
*
*
MASTER_ACCOUNT_MISSING_CONTACT_INFO: To complete this operation, you must * first provide a valid contact address and phone number for the management * account. Then try the operation again.
*
*
MASTER_ACCOUNT_NOT_GOVCLOUD_ENABLED: To complete this operation, the * management account must have an associated account in the Amazon Web Services GovCloud * (US-West) Region. For more information, see Organizations * in the * Amazon Web Services GovCloud User Guide.
*
*
MASTER_ACCOUNT_PAYMENT_INSTRUMENT_REQUIRED: To create an organization with * this management account, you first must associate a valid payment instrument, * such as a credit card, with the account. For more information, see Considerations before removing an account from an organization in * the Organizations User Guide.
*
*
MAX_DELEGATED_ADMINISTRATORS_FOR_SERVICE_LIMIT_EXCEEDED: You attempted to * register more delegated administrators than allowed for the service principal. *
*
*
MAX_POLICY_TYPE_ATTACHMENT_LIMIT_EXCEEDED: You attempted to exceed the number * of policies of a certain type that can be attached to an entity at one * time.
*
*
MAX_TAG_LIMIT_EXCEEDED: You have exceeded the number of tags allowed on this * resource.
*
*
MEMBER_ACCOUNT_PAYMENT_INSTRUMENT_REQUIRED: To complete this operation with * this member account, you first must associate a valid payment instrument, such * as a credit card, with the account. For more information, see Considerations before removing an account from an organization in * the Organizations User Guide.
*
*
MIN_POLICY_TYPE_ATTACHMENT_LIMIT_EXCEEDED: You attempted to detach a policy * from an entity that would cause the entity to have fewer than the minimum number * of policies of a certain type required.
*
*
ORGANIZATION_NOT_IN_ALL_FEATURES_MODE: You attempted to perform an operation * that requires the organization to be configured to support all features. An * organization that supports only consolidated billing features can't perform this * operation.
*
*
OU_DEPTH_LIMIT_EXCEEDED: You attempted to create an OU tree that is too many * levels deep.
*
*
OU_NUMBER_LIMIT_EXCEEDED: You attempted to exceed the number of OUs that you * can have in an organization.
*
*
POLICY_CONTENT_LIMIT_EXCEEDED: You attempted to create a policy that is larger * than the maximum size.
*
*
POLICY_NUMBER_LIMIT_EXCEEDED: You attempted to exceed the number of policies * that you can have in an organization.
*
*
POLICY_TYPE_ENABLED_FOR_THIS_SERVICE: You attempted to disable service access * before you disabled the policy type (for example, SECURITYHUB_POLICY). To * complete this operation, you must first disable the policy type.
*
*
RESPONSIBILITY_TRANSFER_MAX_INBOUND_QUOTA_VIOLATION: You have exceeded your inbound * transfers limit.
*
*
RESPONSIBILITY_TRANSFER_MAX_LEVEL_VIOLATION: You have exceeded the maximum length of your * transfer chain.
*
*
RESPONSIBILITY_TRANSFER_MAX_OUTBOUND_QUOTA_VIOLATION: You have exceeded your outbound * transfers limit.
*
*
RESPONSIBILITY_TRANSFER_MAX_TRANSFERS_QUOTA_VIOLATION: You have exceeded the maximum * number of inbound transfers allowed in a transfer chain.
*
*
SERVICE_ACCESS_NOT_ENABLED:
*
- *
  You attempted to register a delegated administrator before you enabled * service access. Call the EnableAWSServiceAccess API * first.
  *
- *
  You attempted to enable a policy type before you enabled service * access. Call the EnableAWSServiceAccess API first.
  *
*
*
TAG_POLICY_VIOLATION: You attempted to create or update a resource with tags * that are not compliant with the tag policy requirements for this account.
*
*
TRANSFER_RESPONSIBILITY_SOURCE_DELETION_IN_PROGRESS: The source organization cannot accept * this transfer invitation because it is marked for deletion.
*
*
TRANSFER_RESPONSIBILITY_TARGET_DELETION_IN_PROGRESS: The source organization cannot accept * this transfer invitation because target organization is marked for deletion.
*
*
TRANSFER_RESPONSIBILITY_UPDATE_NOT_ALLOWED: You cannot update this transfer * because it is no longer active. Transfers that have been withdrawn, declined, * expired, or cancelled cannot be modified.
*
*
UNMET_BILLING_PREREQUISITE: Your current billing configuration is unsupported. * Contact Amazon Web Services Support for assistance.
*
*
UNSUPPORTED_PRICING: Ineligible for Billing Transfer. Your organization is * subject to a pricing agreement with Amazon Web Services that Billing Transfer does not * support.
*
*
WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at * least four days after the account was created. Invited accounts aren't subject * to this waiting period.
*

* * @throws {@link InvalidInputException} (client fault) *

The requested operation failed because you provided invalid values for one or more of * the request parameters. This exception includes a reason that contains additional * information about the violated limit:

* *

Some of the reasons in the following list might not be applicable to this specific * API or operation.

* *

*
CALLER_REQUIRED_FIELD_MISSING: At least one of the required field is missing: Caller Account Id, Management Account Id or Organization Id.
*
*
DUPLICATE_TAG_KEY: Tag keys must be unique among the tags attached to the same * entity.
*
*
END_DATE_NOT_END_OF_MONTH: You provided an invalid end date. The end date must be the end * of the last day of the month (23.59.59.999).
*
*
END_DATE_TOO_EARLY: You provided an invalid end date. The end date is too early.
*
*
END_DATE_TOO_LATE: You provided an invalid end date. The end date is too late.
*
*
IMMUTABLE_POLICY: You specified a policy that is managed by Amazon Web Services and can't be * modified.
*
*
INPUT_REQUIRED: You must include a value for all required parameters.
*
*
INVALID_EMAIL_ADDRESS_TARGET: You specified an invalid email address for the * invited account owner.
*
*
INVALID_END_DATE: The selected withdrawal date doesn't meet the minimum notice * period required by your partner agreement. Visit Amazon Web Services Partner Central or contact your Amazon Web Services * Channel Partner for help.
*
*
INVALID_ENUM: You specified an invalid value.
*
*
INVALID_ENUM_POLICY_TYPE: You specified an invalid policy type string.
*
*
INVALID_FULL_NAME_TARGET: You specified a full name that contains invalid * characters.
*
*
INVALID_LIST_MEMBER: You provided a list to a parameter that contains at least * one invalid value.
*
*
INVALID_PAGINATION_TOKEN: Get the value for the NextToken * parameter from the response to a previous call of the operation.
*
*
INVALID_PARTY_TYPE_TARGET: You specified the wrong type of entity (account, * organization, or email) as a party.
*
*
INVALID_PATTERN: You provided a value that doesn't match the required * pattern. The service also validates your free-text field values against * common cross-site scripting (XSS) patterns and rejects requests that * contain matching values.
*
*
INVALID_PATTERN_TARGET_ID: You specified a policy target ID that doesn't match * the required pattern.
*
*
INVALID_PRINCIPAL: You specified an invalid principal element in the * policy.
*
*
INVALID_ROLE_NAME: You provided a role name that isn't valid. A role name * can't begin with the reserved prefix AWSServiceRoleFor.
*
*
INVALID_START_DATE: The start date doesn't meet the minimum requirements.
*
*
INVALID_SYNTAX_ORGANIZATION_ARN: You specified an invalid Amazon Resource Name * (ARN) for the organization.
*
*
INVALID_SYNTAX_POLICY_ID: You specified an invalid policy ID.
*
*
INVALID_SYSTEM_TAGS_PARAMETER: You specified a tag key that is a system tag. * You can’t add, edit, or delete system tag keys because they're reserved for * Amazon Web Services use. System tags don’t count against your tags per resource limit.
*
*
MAX_FILTER_LIMIT_EXCEEDED: You can specify only one filter parameter for the * operation.
*
*
MAX_LENGTH_EXCEEDED: You provided a string parameter that is longer than * allowed.
*
*
MAX_VALUE_EXCEEDED: You provided a numeric parameter that has a larger value * than allowed.
*
*
MIN_LENGTH_EXCEEDED: You provided a string parameter that is shorter than * allowed.
*
*
MIN_VALUE_EXCEEDED: You provided a numeric parameter that has a smaller value * than allowed.
*
*
MOVING_ACCOUNT_BETWEEN_DIFFERENT_ROOTS: You can move an account only between * entities in the same root.
*
*
NON_DETACHABLE_POLICY: You can't detach this Amazon Web Services Managed Policy.
*
*
START_DATE_NOT_BEGINNING_OF_DAY: You provided an invalid start date. The start date must * be the beginning of the day (00:00:00.000).
*
*
START_DATE_NOT_BEGINNING_OF_MONTH: You provided an invalid start date. The start date must * be the first day of the month.
*
*
START_DATE_TOO_EARLY: You provided an invalid start date. The start date is too early.
*
*
START_DATE_TOO_LATE: You provided an invalid start date. The start date is too late.
*
*
TARGET_NOT_SUPPORTED: You can't perform the specified operation on that target * entity.
*
*
UNRECOGNIZED_SERVICE_PRINCIPAL: You specified a service principal that isn't * recognized.
*
*
UNSUPPORTED_ACTION_IN_RESPONSIBILITY_TRANSFER: You provided a value that is not supported * by this operation.
*

* * @throws {@link PolicyChangesInProgressException} (client fault) *

Changes to the effective policy are in progress, and its contents can't be returned. * Try the operation again later.

* * @throws {@link PolicyNotAttachedException} (client fault) *

The policy isn't attached to the specified target in the specified root.

* * @throws {@link PolicyNotFoundException} (client fault) *

We can't find a policy with the PolicyId that you specified.

* * @throws {@link ServiceException} (server fault) *

Organizations can't complete your request because of an internal service error. Try again * later.

* * @throws {@link TargetNotFoundException} (client fault) *

We can't find a root, OU, account, or policy with the TargetId that you * specified.

* * @throws {@link TooManyRequestsException} (client fault) *

You have sent too many requests in too short a period of time. The quota helps protect * against denial-of-service attacks. Try again later.

For information about quotas that affect Organizations, see Quotas for Organizations in the * Organizations User Guide.

* * @throws {@link UnsupportedAPIEndpointException} (client fault) *

This action isn't available in the current Amazon Web Services Region.

* * @throws {@link OrganizationsServiceException} *

Base exception class for all service exceptions from Organizations service.

* * * @example To detach a policy from a root, OU, or account * ```javascript * // The following example shows how to detach a policy from an OU:/n/n * const input = { * PolicyId: "p-examplepolicyid111", * TargetId: "ou-examplerootid111-exampleouid111" * }; * const command = new DetachPolicyCommand(input); * const response = await client.send(command); * /* response is * { /* metadata only *\/ } * *\/ * ``` * * @public */ export declare class DetachPolicyCommand extends DetachPolicyCommand_base { /** @internal type navigation helper, not in runtime. */ protected static __types: { api: { input: DetachPolicyRequest; output: {}; }; sdk: { input: DetachPolicyCommandInput; output: DetachPolicyCommandOutput; }; }; }