Question

A company uses AWS IAM Identity Center (successor to AWS SSO) to manage workforce access across 40 accounts in an organization. The security team wants developers in the 'AppDev' group to receive identical read/write permissions to a specific set of DynamoDB tables in every account, but the exact table ARNs differ per account because they include the account ID. Administrators must be able to update the permission logic in one place and have it propagate to all assigned accounts automatically. Which approach BEST meets these requirements?

Accepted Answer

Create one permission set whose inline policy uses the ${aws:PrincipalAccount} policy variable in the DynamoDB resource ARNs, assign it to the AppDev group for all target accounts, and edit the permission set once to propagate changes.

Answer

Create one permission set with an inline policy that references the DynamoDB tables using a wildcard and the aws:PrincipalAccount condition key, then assign it to the AppDev group across all accounts.

Answer

Create a separate IAM role with an inline policy in each of the 40 accounts and configure IAM Identity Center to assume each role individually per account.

Answer

Attach an AWS managed policy such as AmazonDynamoDBFullAccess to a permission set and assign it to the AppDev group, relying on SCPs to restrict which tables can be accessed.