Question

A large enterprise uses AWS IAM Identity Center federated with an external corporate identity provider. The company has 300 AWS accounts organized by business unit and project. As teams grow, the security team is overwhelmed by creating and maintaining separate permission sets for every combination of business unit and project. They want engineers to only access resources tagged with their own business unit, without creating hundreds of unique permission sets. Which approach best meets this requirement with the least ongoing administrative overhead?

Accepted Answer

Configure attribute-based access control (ABAC) in IAM Identity Center by passing identity provider attributes as session tags, and write permission set policies that use condition keys to match those tags against resource tags.

Answer

Create a unique permission set per business unit and assign it to the corresponding accounts, updating the assignments manually whenever a team changes.

Answer

Use a service control policy at each business unit OU that references the user's group membership to restrict access to matching resources.

Answer

Provision individual IAM users in each account with inline policies that grant access based on the user's business unit, synchronized via SCIM.