Question

A financial services company uses AWS IAM Identity Center (successor to AWS SSO) with an external SAML identity provider to grant developers access across 40 accounts in AWS Organizations. Each developer receives a permission set that grants broad access to build resources, including full IAM privileges within their assigned workload accounts. A security audit discovers that developers can create new IAM roles and attach the AdministratorAccess policy, effectively escalating their own privileges beyond what the permission set intended. The security team wants to cap the maximum permissions any IAM entity created by developers can ever have, without removing developers' ability to create roles for their applications. Which approach best addresses this requirement?

Accepted Answer

Require that developers, when creating roles, attach a customer-managed permissions boundary policy, and use a permission set inline policy condition that denies role creation unless the approved boundary is set.

Answer

Modify the permission set to remove all IAM write actions, and have a central team provision every application role via a ticketing workflow.

Answer

Attach a service control policy to the workload OU that denies iam:CreateRole and iam:AttachRolePolicy for all principals in those accounts.

Answer

Reduce the permission set session duration to one hour so escalated credentials expire quickly and cannot be reused.