Customer Managed Policies (CMPs) attached to AWS SSO Permission Set

The support for customer managed policies by identity center was released July 2022.

One thing that might have confused you is, Identity Center (SSO) "allows you to manage everything via a centralized account", but it does not provision those customer managed policies for you. You need to make sure that the policy referred to from the permission set actually exists and they are the same across the different accounts that you assign your user/groups to.

Yes you can add/remove customer managed polices to/from permission sets and have identity center to update the permission sets (they end up as roles) across the accounts. (again, update of permission set, not the customer managed policy)

I got the answer for this. The feature of attaching Customer Managed Policies (CMPs) to AWS SSO permission set was introduced in Amazon Reinvent 2022. It provides a way to manage your IAM permissions without letting you disturbed all the member accounts access using SSOInlinePolicy. Steps to attach a CMP to permission set are:

1. Create a CMPs with consistent names in your target accounts i.e. each CMP needs to have the same name.
2. Create a permission set that references the CMP that you created.
3. Assign users to the permission set in accounts where you created CMPs.
4. Test your assignments.