How to control per user per account permissions with IAM identity center?

Question

I am struggling with IAM Identity center. 
I want to make sure user Y can only assume power user role when accessing account Z. 
It is not clear to me how I can achieve that when all permissions sets are assigned on an account level and not a user level.

I have the following permissions sets assigned to an account
![Enter image description here](/media/postImages/original/IMGDoYEtHtQP2ScQQK6LR4YA)
The console says that I can assigned permissions to a group
[![Enter image description here](/media/postImages/original/IM6fSLr__XRXSkKzMSg3ZE8w)
]()
But when I start assigning permissions sets, they are assigned to ACCOUNTS only. So there is no way to say user X can only be PowerUser but not Administrator when accessing the account Y
![Enter image description here](/media/postImages/original/IMYHIqZZsARrmPizyOy8vwOA)

Here is the stack overflow questions (that doesn't have an answer)
https://stackoverflow.com/questions/74417061/how-to-manage-user-roles-with-aws-iam-identity-center

Answer

Hi, you should understand the two core components of the AWS IAM Identity Center service.

## Core Components

### Permission Set

A permission set is a template you create and maintain that defines a collection of one or more IAM policies. Permission sets simplify the assignment of AWS account access for users and groups in your organization.
You can think that a permission set is a reusable role with proper permissions, which can be used in several AWS accounts in the same AWS Organization.

### Account Assignment

An account assignment is the task of assigning a permission set for a specific AWS account to multiple users or groups.

## Answer

You can create an account assignment for the `PowerUser` permission set of the AWS account to user X.

## References

- [Permission sets](https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html)
- [Account Assignment](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateAccountAssignment.html)

How to control per user per account permissions with IAM identity center?

Core Components

Permission Set

Account Assignment

Answer

References

관련 콘텐츠