Question

A financial services company wants to let its development team create their own IAM roles for Lambda functions without opening a ticket each time. Security requires that any role the developers create can never grant more than read/write access to a specific set of DynamoDB tables and S3 buckets, even if the developers attach broader policies. Which approach meets these requirements with the least ongoing administrative effort?

Accepted Answer

Create an IAM permissions boundary that defines the maximum allowed permissions, and give developers a policy that only allows creating roles which have that permissions boundary attached.

Answer

Grant developers iam:CreateRole permission and require the security team to review every new role during a weekly audit.

Answer

Attach a service control policy (SCP) to the developers' IAM users limiting them to DynamoDB and S3 actions.

Answer

Provide developers a set of pre-built roles managed by the security team and deny all iam:CreateRole actions.