Question

A company allows developers in each project team to create IAM roles for their own applications so they can move quickly. Security is concerned that a developer could create a role with full administrative access and attach it to an application. The security team wants developers to retain the ability to create roles and attach policies, but wants to guarantee that any role they create can never obtain permissions beyond a defined set (such as S3, DynamoDB, and CloudWatch access). What is the MOST appropriate way to enforce this constraint?

Accepted Answer

Attach a permission boundary to the developer IAM users and use a condition that requires them to attach the same permission boundary to any role they create.

Answer

Create a Service Control Policy in AWS Organizations that denies the iam:CreateRole action for all developers.

Answer

Grant developers full IAM access and rely on AWS Config rules to detect and delete any overly permissive roles after creation.

Answer

Use IAM Access Analyzer to continuously scan created roles and automatically revoke administrative permissions.