Question

A financial services company allows senior data engineers to create IAM roles for their own Glue jobs and Lambda functions. The security team is concerned that engineers could create roles with broader permissions than intended (for example, granting full S3 or KMS access to production buckets). The team wants to guarantee that any role an engineer creates can never exceed a defined maximum set of permissions, regardless of the policies the engineer attaches. Which approach meets this requirement?

Accepted Answer

Attach a permissions boundary to the engineers' IAM roles that constrains the maximum permissions of any roles they create, and require the boundary to be attached to newly created roles

Answer

Attach a resource-based S3 bucket policy that denies access to any role created by the data engineers

Answer

Enable IAM Access Analyzer to automatically remove excessive permissions from roles the engineers create

Answer

Grant the engineers only the iam:CreateRole permission and rely on the least-privilege default of new roles