Question

A company uses AWS IAM Identity Center (successor to AWS SSO) with an external SAML 2.0 identity provider. A security engineer creates a permission set named 'DataAnalyst' and assigns a group to it across 12 member accounts in the organization. Two weeks later, the engineer edits the inline policy inside the DataAnalyst permission set to add read access to a new S3 bucket. However, users report that the new S3 permissions are not taking effect in any of the accounts. What is the MOST likely cause and correct action?

Accepted Answer

Editing a permission set does not automatically re-provision the corresponding IAM roles in assigned accounts; the engineer must reprovision the permission set to push the updated policy to all accounts.

Answer

IAM Identity Center automatically syncs permission set changes only at the next SAML login; users must clear their browser cache to force re-provisioning of the IAM role.

Answer

The S3 bucket policy must explicitly grant access to the Identity Center-generated role ARN before permission set changes take effect in member accounts.

Answer

Permission sets support only AWS managed policies for cross-account provisioning; inline policy edits are ignored and must be replaced with a customer managed policy reference.