Question

A security team wants to let application developers create and manage IAM roles for their own workloads without being able to grant those roles more permissions than the developers themselves are allowed. Developers currently have an identity policy that allows iam:CreateRole, iam:AttachRolePolicy, and iam:PutRolePolicy. The security team is concerned developers could create a role with AdministratorAccess and then assume it to escalate privileges. Which approach enforces this restriction with least operational overhead?

Accepted Answer

Attach a permissions boundary managed policy that defines the maximum permissions, and add a condition to the developers' identity policy requiring that any role they create or modify must have that permissions boundary attached (iam:PermissionsBoundary).

Answer

Create an SCP in the organization that denies iam:CreateRole for all developer accounts and have the security team create roles on the developers' behalf.

Answer

Attach a resource-based policy to each newly created role that denies any action not explicitly approved by the security team.

Answer

Enable AWS IAM Access Analyzer to automatically remove any AdministratorAccess policy that a developer attaches to a role.