IAM user with AdministratorAccess permission set is unable to access VPCs or IAM

Question

I enables IAM identity centre in the root account of my organisation and created a user with the AdministratorAccess permission set.

After using the Access portal to log in as that user I get the same "complete registration" modal view when trying to view the VPC or IAM resource.

Other resources like S3, DynamoDB etc. seem to be accessible.

I'm just testing a terraform deployment to provision and new VPC and I can neither view the VPC resource in the console or provision the resource via terraform.

The policy is the standard:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]
}
```

What is causing this issue?

Praveen Muppala · Answer

On the other hand, since this issue relates to an IAM Identity Center (IDC) SSO user, it could be due to improper provisioning or incomplete registration, including steps like MFA setup. For more insights, you can review this Repost discussion: Issue with SSO User Registration.

This post provides helpful information on troubleshooting SSO user registration issues.

Praveen Muppala · Answer

Hello CPB,

Are you familiar with AWS Organizations and the Service Control Policies (SCPs) implemented within your account structure? It's possible that the restrictions you're experiencing could be related to the SCPs configured at the AWS Organization level.

For further clarification, I recommend reviewing the following resources:

- [Policies and Permissions in AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html)

- [IAM Policy Types: How and When to Use Them](https://aws.amazon.com/blogs/security/iam-policy-types-how-and-when-to-use-them/)

IAM user with AdministratorAccess permission set is unable to access VPCs or IAM

Relevant content