Why is a AWSReservedSSO_PowerUserAccess policy holder blocked from performing an action?

Question

When testing out AWS SSO before a full rollout, we've run into a few errors with permissions. Most are non-issues, but this error (below) surprised me-- why would a PowerUser policy holder not have the ability to perform every action they try to perform?

```
Failed to describe Instance Profiles
Failed to describe Instance Profiles. User: arn:aws:sts::x123x:assumed-role/AWSReservedSSO_PowerUserAccess_x123x/dev@email.com is not authorized to perform: iam:ListInstanceProfiles on resource: arn:aws:iam::x123x:instance-profile/ because no identity-based policy allows the iam:ListInstanceProfiles action.
```

Accepted Answer

Hello,

The PowerUser will have access to every service except for some permissions regarding the IAM service. As you can see, you are trying to perform an action on the IAM service iam:ListInstanceProfiles. 
The Power User does not have access to the IAM API actions because managing users is the most powerful tool in AWS. The reason why managing users is so powerful is that if somebody has full access to the IAM service, that identity can grant himself or other users any permission that that identity wants.

PowerUserAccess = Admin Acess - IAM

Why is a AWSReservedSSO_PowerUserAccess policy holder blocked from performing an action?

Relevant content