Question

A SysOps administrator must allow a team of application developers to create new IAM roles for their Lambda functions. Security policy requires that any role the developers create must never be able to grant permissions beyond a defined set of services (Lambda, DynamoDB, and CloudWatch Logs), even if the developer attaches broader policies. The developers should still be able to create and manage roles independently. What is the MOST effective way to enforce this constraint?

Accepted Answer

Grant the developers iam:CreateRole permission with a condition requiring that a specific permissions boundary policy be attached to every role they create.

Answer

Attach a permissions boundary policy to the developers' IAM role that limits their own actions to the three services.

Answer

Create a Service Control Policy (SCP) on the account that denies all API calls outside Lambda, DynamoDB, and CloudWatch Logs.

Answer

Use IAM Access Analyzer to continuously scan created roles and automatically detach any policy granting excessive permissions.