Question

A financial services company uses AWS IAM Identity Center (successor to AWS SSO) with an external SAML identity provider to grant workforce access across 40 accounts in AWS Organizations. The security team defines permission sets that reference AWS managed policies. Developers report that when they attempt to attach a large custom inline policy plus several AWS managed policies to a single permission set, provisioning to member accounts fails. The team also needs the ability to constrain the maximum permissions any assigned user can ever receive through a permission set, regardless of the policies attached. Which combination of actions correctly addresses both the provisioning failure and the permission-ceiling requirement?

Accepted Answer

Reduce the number of managed policies and shorten the inline policy to stay within the permission set IAM role size limits, and attach a permissions boundary to the permission set to cap the effective permissions of the provisioned roles.

Answer

Split the permission set into multiple permission sets and assign all of them to the same user, then apply an SCP to the management account to cap the user's effective permissions.

Answer

Convert the inline policy into a customer managed policy referenced by name in every member account, and rely on session duration settings to limit what the user can do.

Answer

Increase the IAM policy size quota via a Service Quotas request for each member account, and attach a resource-based policy to the permission set to enforce the permission ceiling.