How do I resolve the "Cannot perform the operation on the protected role AWSReservedSSO" IAM error?

Resolution

When you use the IAM console to modify a role name that begins with AWSReservedSSO, you might receive the following error:
"Cannot perform the operation on the protected role 'AWSReservedSSO_RoleName_Here' - this role is only modifiable by AWS"

To modify roles that begin with AWSReservedSSO, you must use the AWS IAM Identity Center console, instead of the IAM console. For more information, see I get a ‘Cannot perform the operation on the protected role' error when modifying an IAM role.

To use the IAM Identity Center console to modify the role name, either edit an inline policy or attach a customer managed policy.
Note: Make sure that your policy has the required permissions in your AWS Organizations member account.

Option 1: Edit an inline policy

Complete the following steps:

1. Open the IAM Identity Center console.
   Note: Make sure that you're logged in with your Organizations management account.
2. In the navigation pane, under Multi-account permissions, choose Permission sets.
3. Choose the permission set that you want to modify.
4. In Inline policy, choose Edit.
5. In the JSON document editor, enter an inline policy to give permissions for your use case.
6. Choose Save changes.

Option 2: Attach a customer managed policy

Complete the following steps:

1. Open the IAM Identity Center console.
   Note: Make sure that you're logged in with your Organizations management account.
2. In the navigation pane, under Multi-account permissions, choose Permission sets.
3. Choose the permission set that you want to attach the managed policy to.
4. In Customer managed policies, choose Attach policies.
   Note: You must have an IAM policy that matches the name and path in each AWS account where you want to deploy your permission set.
5. In policy names, enter the name of the managed policy in your member account.
6. Choose Attach policies.

Related information

How do I use IAM Identity Center permission sets?

Single sign-on access to AWS accounts