Question

A company allows individual application teams to create their own IAM roles for Lambda functions and EC2 instances so they can move quickly. The security team is concerned that developers could create roles with more privileges than they themselves hold, effectively escalating privileges. The security team wants to let developers continue self-servicing IAM role creation, but guarantee that no role they create can ever exceed a defined maximum set of permissions, and that developers cannot bypass the control by editing or deleting it. Which approach BEST meets these requirements?

Accepted Answer

Attach an IAM permissions boundary policy defining the maximum allowed permissions, and use an IAM policy condition (iam:PermissionsBoundary and Deny on iam:DeleteRolePermissionsBoundary) so developers can only create roles that have the mandated boundary attached.

Answer

Grant developers full iam:CreateRole permissions and rely on AWS Config custom rules to detect and delete any role that has excessive permissions after creation.

Answer

Create the roles centrally in a shared services account and have developers assume them via cross-account trust so they never call IAM APIs directly.

Answer

Apply a Service Control Policy that denies all iam:CreateRole calls, and require developers to open a ticket for the security team to create each role manually.