Question

A CloudOps engineer manages an AWS account where 40 developers each have IAM users. Currently, permissions are assigned by attaching inline policies directly to each user, and updating a single permission requires editing every user individually. The team wants a scalable approach that reduces administrative overhead and ensures consistent permissions across all developers, while still allowing a subset of developers to receive additional temporary permissions when working on a special project. Which approach best meets these requirements?

Accepted Answer

Create an IAM group with a managed policy for the common developer permissions and add all developers to it; create a second group for the special-project permissions and add only the relevant developers to that group.

Answer

Consolidate all permissions into a single AWS managed policy and attach it as an inline policy to each of the 40 IAM users.

Answer

Create a permission boundary that grants the common developer permissions and attach it to each IAM user, updating the boundary when the special project starts.

Answer

Create one IAM role with all common and special-project permissions and share its access keys with all 40 developers.