Question

A security team manages a 40-account AWS Organization. They want to guarantee that developers in workload accounts cannot create IAM users with long-lived access keys, but must still allow the organization's central identity provisioning role (arn:aws:iam::*:role/OrgIdentityProvisioner) to create service accounts when absolutely required. The solution must apply organization-wide and be enforced regardless of any permissions granted by account administrators. Which approach best meets these requirements?

Accepted Answer

Attach an SCP to the root that denies iam:CreateUser and iam:CreateAccessKey, using a condition with aws:PrincipalARN (StringNotLike) to exclude the OrgIdentityProvisioner role.

Answer

Create an AWS Config managed rule iam-user-no-policies-check in each account and configure automatic remediation to delete newly created IAM users.

Answer

Add a permissions boundary to every IAM principal in the workload accounts that denies iam:CreateUser except for the provisioner role.

Answer

Attach an IAM identity policy with an explicit deny on iam:CreateUser to each developer group in the workload accounts.