Limit IAM Identity Center Users to defined Region

Question

# Requirement
I have been able to set up IAM Identity Center and provide log-in credentials for access to AWS services (let's use S3 as an example), however, I'd like to limit any console access to this service to a single region to isolate some user's workspace from other's.

# Attempted Config
I created the following IAM policy named `RegionRestrict` then imported it into IAM Identity Center when mapping a user to an AWS Organizations account. I referred to a few guides and found that the Condition shared in this guide  only applies to API requests (and not console access), thus I ended up using `ec2:Region` instead of the global region flag.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "ec2:*",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ec2:Region": "us-east-1"
                }
            }
        }
    ]
}
```

# Issues
When assigning a Permissions set to a user, I receive the following error:
```
1 of 1 failed to be configured.
You can retry submitting them, or you can leave the page and the failed assignments won’t be submitted.

Assign user "permission-test" to AWS account "permissions-test" with permission set "RegionRestrict"

Received a 404 status error: Not supported policy arn:aws:iam::############:policy/RegionRestrict.
```

Accepted Answer

For IAM Identity Center, you'll want to create Permission Sets which are templates that define the policies users will receive. You should also look at aws:RequestedRegion for a relevant context key to use in policies.

The API permissions apply to both console and programmatic access, however the key you're using is an EC2 one so it wouldn't necessarily apply to all services.

BTW, you might want to look at Service Control Policies if these users are logging in to linked accounts, there a very relevant example in the docs.

The API permissions apply to both console and programmatic access, however the key you're using is an EC2 one so it wouldn't necessarily apply to all services.

BTW, you might want to look at [Service Control Policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) if these users are logging in to linked accounts, there a very [relevant example](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html#example-scp-deny-region) in the docs.

Answer

To attach a customer-managed policy to a permission set, you need to first create the policy with the same name in all of the accounts to which the permission set will be attached.

Limit IAM Identity Center Users to defined Region

Requirement

Attempted Config

Issues

Relevant content