Question

A security engineer manages an AWS Organization with 200 accounts. Developers in member accounts have broad IAM permissions, including iam:CreateRole and iam:AttachRolePolicy. The security team wants to prevent any developer from creating or modifying roles that could grant themselves administrative access, while still allowing developers to create service roles for their applications. The team has defined that all developer-created roles MUST have a permissions boundary policy named 'DeveloperBoundary' attached. Which Service Control Policy (SCP) approach best enforces this requirement across all member accounts?

Accepted Answer

Attach an SCP that denies iam:CreateRole and iam:PutRolePolicy unless the request includes a condition matching the permissions boundary ARN via the iam:PermissionsBoundary condition key.

Answer

Attach an SCP that allows iam:CreateRole only for roles tagged with a specific project tag, relying on ABAC to constrain the role's effective permissions.

Answer

Attach the DeveloperBoundary policy directly as an SCP to each member account's organizational unit so it applies to all principals automatically.

Answer

Create an identity-based policy in each account that grants iam:CreateRole and use a resource-based policy on the IAM service to require the boundary.