Question

A security team wants to let application developers create IAM roles for their Lambda functions without opening a ticket, but must prevent developers from granting those roles more permissions than the developers themselves are allowed to use. The team creates a managed policy that defines the maximum allowable permissions and requires developers to attach it as a permission boundary to any role they create. However, developers are still able to create roles that omit the boundary entirely, gaining broader access. What is the MOST effective way to enforce that every role created by developers has the required permission boundary attached?

Accepted Answer

Add a condition to the developers' IAM policy using iam:PermissionsBoundary that only allows iam:CreateRole and iam:PutRolePolicy when the specified boundary ARN matches the required managed policy.

Answer

Attach the permission boundary managed policy directly to the developers' IAM users so it automatically propagates to any role they create.

Answer

Create a Service Control Policy that denies iam:CreateRole for the entire organization and rely on the security team to create roles manually.

Answer

Configure an AWS Config rule that flags roles without the boundary and use automatic remediation to delete non-compliant roles after creation.