Saltar al contenido
Al usar AWS re:Post, aceptas las AWS re:Post Términos de uso
AWS re:Postre:Post
Acerca de re:Post

managing permission sets for SSO users

0

We're currently using AWS SSO and assigning the poweruser permission set to all SSO users across accounts in AWS Organizations. However, we're getting requests from SSO users for more limited access (a user may only need to access S3 buckets or EC2 instances and power user is much too powerful for them, for example). Short of creating a permission set for every possible use case, is there a more efficient way of managing this centrally?

Temas
Seguridad, identidad y cumplimiento
Etiquetas
Centro de identidad de AWS IAM
Idioma
English

preguntada hace 2 años356 visualizaciones

1 Respuesta
0

You can create a new permission set and attach the policy only SSO users needed to the permission set. More informations, please refer to https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html

AWS
EXPERTO

respondido hace 2 años

  • rePost-User-2683144
    hace 2 años

    Thanks for the response. However my problem is managing multiple permission sets for different SSO users across AWS accounts. Example:

    • SSO User Joe only needs access to S3 buckets in Account A
    • SSO User Bill only needs access to VPCs and EC2 in Account A
    • SSO User Mary only needs access to RDS and EC2 in Account B
    • SSO User Sarah only needs access to WAF in Account B

    Other than creating a separate permission set for each of these cases, is there an easier way to manage permissions that will scale? We have over 50 accounts in our AWS Organizations and the SSO users will need varying levels of access. I don't want to have to manage hundreds of permission sets.

    Thanks!

  • AWS-Jinhong EXPERTO
    hace 2 años

    It's better to use ABAC( Attribute Based Access Control). Tag different resources within each account with permission tag, and add condition statement in the IAM policy. You can refer to this link for more details: https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html .

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Contenido relevante