managing permission sets for SSO users

Thanks for the response. However my problem is managing multiple permission sets for different SSO users across AWS accounts. Example:

• SSO User Joe only needs access to S3 buckets in Account A
• SSO User Bill only needs access to VPCs and EC2 in Account A
• SSO User Mary only needs access to RDS and EC2 in Account B
• SSO User Sarah only needs access to WAF in Account B

Other than creating a separate permission set for each of these cases, is there an easier way to manage permissions that will scale? We have over 50 accounts in our AWS Organizations and the SSO users will need varying levels of access. I don't want to have to manage hundreds of permission sets.

Thanks!

It's better to use ABAC( Attribute Based Access Control). Tag different resources within each account with permission tag, and add condition statement in the IAM policy. You can refer to this link for more details: https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html .