Organization Members cannot see or access my amplify projects

Let’s troubleshoot this issue step by step:

1. IAM Identity Center (SSO) Permissions: The permissions you’ve assigned look correct, but let’s double-check a few things:

• Ensure that the permission set is actually assigned to the developers’ user accounts in IAM Identity Center.
• Verify that the developers are using the correct AWS account when accessing Amplify.

2. SCP Evaluation:

• Check if there are any SCPs applied to the OU or account where the developers’ accounts reside.

3. Look for SCPs that might be restricting access to Amplify services or specific regions.
4. Region Consistency:

• Confirm that the developers are accessing the same region where the Amplify apps are deployed.
• AWS Amplify resources are region-specific, so if the app is in us-east-1, but the developer is viewing us-west-2, they won’t see the apps.

5. AWS CLI Configuration:

• For the AWS CLI, ensure that the developers have properly configured their credentials using AWS SSO.
• They should run aws configure sso and follow the prompts to set up their CLI access.

6. Amplify App Sharing:

• In some cases, Amplify apps might need to be explicitly shared with team members.
• Check if the Amplify app settings have any restrictions on who can view or access the app.

7. IAM Policy Verification:

• Double-check the exact permissions in the AdministratorAccess-Amplify and AmplifyBackendDeployFullAccess policies.
• Ensure they include the necessary read permissions like amplify:ListApps.

8. CloudTrail Logs:

• Consider checking CloudTrail logs to see if there are any permission-related errors when developers try to access Amplify resources.

9. Amplify Service Role:

• Verify if there’s a service role associated with your Amplify app and ensure it has the necessary permissions.

10. Cross-Account Access:

• If the Amplify app is in a different AWS account than the developers’ SSO access, ensure proper cross-account permissions are set up.

11. Console vs CLI Discrepancy:

• The fact that both console and CLI access fail suggests a permissions issue rather than a configuration problem.

12. Temporary Solution for Troubleshooting:

• Temporarily assign a more permissive policy (like ReadOnlyAccess) to see if it resolves the issue. This can help isolate whether it’s a specific Amplify permission or a broader access issue.

Next steps:

1. Can you verify the exact error message developers see when trying to access Amplify through the console?
2. Have you checked CloudTrail logs for any access denied events related to Amplify?
3. Can you confirm that the developers are definitely in the correct AWS account and region when attempting to access the Amplify resources?

Providing this information will help further diagnose the issue.