:doc:`Organizations <../../organizations>` / Client / detach_policy

*************
detach_policy
*************



.. py:method:: Organizations.Client.detach_policy(**kwargs)

  

  Detaches a policy from a target root, organizational unit (OU), or account.

   

  .. warning::

     

    If the policy being detached is a service control policy (SCP), the changes to permissions for Identity and Access Management (IAM) users and roles in affected accounts are immediate.

     

   

  Every root, OU, and account must have at least one SCP attached. If you want to replace the default ``FullAWSAccess`` policy with an SCP that limits the permissions that can be delegated, you must attach the replacement SCP before you can remove the default SCP. This is the authorization strategy of an " `allow list <https://docs.aws.amazon.com/organizations/latest/userguide/SCP_strategies.html#orgs_policies_allowlist>`__". If you instead attach a second SCP and leave the ``FullAWSAccess`` SCP still attached, and specify ``"Effect": "Deny"`` in the second SCP to override the ``"Effect": "Allow"`` in the ``FullAWSAccess`` policy (or any other attached SCP), you're using the authorization strategy of a " `deny list <https://docs.aws.amazon.com/organizations/latest/userguide/SCP_strategies.html#orgs_policies_denylist>`__".

   

  You can only call this operation from the management account or a member account that is a delegated administrator.

  

  See also: `AWS API Documentation <https://docs.aws.amazon.com/goto/WebAPI/organizations-2016-11-28/DetachPolicy>`_  


  **Request Syntax**
  ::

    response = client.detach_policy(
        PolicyId='string',
        TargetId='string'
    )
    
  :type PolicyId: string
  :param PolicyId: **[REQUIRED]** 

    ID for the policy you want to detach. You can get the ID from the  ListPolicies or  ListPoliciesForTarget operations.

     

    The `regex pattern <http://wikipedia.org/wiki/regex>`__ for a policy ID string requires "p-" followed by from 8 to 128 lowercase or uppercase letters, digits, or the underscore character (_).

    

  
  :type TargetId: string
  :param TargetId: **[REQUIRED]** 

    ID for the root, OU, or account that you want to detach the policy from. You can get the ID from the  ListRoots,  ListOrganizationalUnitsForParent, or  ListAccounts operations.

     

    The `regex pattern <http://wikipedia.org/wiki/regex>`__ for a target ID string requires one of the following:

     

    
    * **Root** - A string that begins with "r-" followed by from 4 to 32 lowercase letters or digits.
     
    * **Account** - A string that consists of exactly 12 digits.
     
    * **Organizational unit (OU)** - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.
    

    

  
  
  :returns: None
  **Exceptions**
  
  *   :py:class:`Organizations.Client.exceptions.AccessDeniedException`

  
  *   :py:class:`Organizations.Client.exceptions.AWSOrganizationsNotInUseException`

  
  *   :py:class:`Organizations.Client.exceptions.ConcurrentModificationException`

  
  *   :py:class:`Organizations.Client.exceptions.ConstraintViolationException`

  
  *   :py:class:`Organizations.Client.exceptions.InvalidInputException`

  
  *   :py:class:`Organizations.Client.exceptions.PolicyNotAttachedException`

  
  *   :py:class:`Organizations.Client.exceptions.PolicyNotFoundException`

  
  *   :py:class:`Organizations.Client.exceptions.ServiceException`

  
  *   :py:class:`Organizations.Client.exceptions.TargetNotFoundException`

  
  *   :py:class:`Organizations.Client.exceptions.TooManyRequestsException`

  
  *   :py:class:`Organizations.Client.exceptions.UnsupportedAPIEndpointException`

  
  *   :py:class:`Organizations.Client.exceptions.PolicyChangesInProgressException`

  

  **Examples**

  The following example shows how to detach a policy from an OU:/n/n
  ::

    response = client.detach_policy(
        PolicyId='p-examplepolicyid111',
        TargetId='ou-examplerootid111-exampleouid111',
    )
    
    print(response)

  
  Expected Output:
  ::

    {
        'ResponseMetadata': {
            '...': '...',
        },
    }

  