Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

managing permission sets for SSO users

0

We're currently using AWS SSO and assigning the poweruser permission set to all SSO users across accounts in AWS Organizations. However, we're getting requests from SSO users for more limited access (a user may only need to access S3 buckets or EC2 instances and power user is much too powerful for them, for example). Short of creating a permission set for every possible use case, is there a more efficient way of managing this centrally?

Topics
Security, Identity, & Compliance
Tags
AWS IAM Identity Center
Language
English

asked 2 years ago350 views

1 Answer
0

You can create a new permission set and attach the policy only SSO users needed to the permission set. More informations, please refer to https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html

AWS
EXPERT

answered 2 years ago

  • rePost-User-2683144
    2 years ago

    Thanks for the response. However my problem is managing multiple permission sets for different SSO users across AWS accounts. Example:

    • SSO User Joe only needs access to S3 buckets in Account A
    • SSO User Bill only needs access to VPCs and EC2 in Account A
    • SSO User Mary only needs access to RDS and EC2 in Account B
    • SSO User Sarah only needs access to WAF in Account B

    Other than creating a separate permission set for each of these cases, is there an easier way to manage permissions that will scale? We have over 50 accounts in our AWS Organizations and the SSO users will need varying levels of access. I don't want to have to manage hundreds of permission sets.

    Thanks!

  • AWS-Jinhong EXPERT
    2 years ago

    It's better to use ABAC( Attribute Based Access Control). Tag different resources within each account with permission tag, and add condition statement in the IAM policy. You can refer to this link for more details: https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html .

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content