Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

How to limit permission to AWS SSO user

0

I have full access to AWS services and resources of a member account, and I can't administer IAM Identity Center from this member account. I used IAM to create IAM user and group for other users. Now we migrate IAM users to AWS SSO, all SSO users have 2 options(ReadOnly or PowerUser), how am I limit or assign SSO user permissions?

Topics
Security, Identity, & Compliance
Tags
AWS IAM Identity CenterSecurity, Identity, & Compliance
Language
English

asked 3 years ago1.2K views

2 Answers
0
Accepted Answer

Hello.
You must operate with an IAM Identity Center administrative account and assign the necessary permissions.
https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetcustom.html

Alternatively, IAM Identity Center administration can be delegated to a specific member account.
In that case, it will be possible to operate the IAM Identity Center from a delegated member account and assign privileges.
https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetcustom.html

EXPERT

answered 3 years ago

EXPERT

reviewed 3 years ago

EXPERT

reviewed 3 years ago

  • Riku_Kobayashi EXPERT
    3 years ago

    I can't set policies for SSO users like in IAM anymore, right?

    It cannot be operated from the IAM screen. Attach IAM policies in the IAM Identity Center permission set.

    May I grant ReadOnly to all SSO users, create IAM role, let SSO user assume role when they need?

    Do you want to set a set of permissions for a user with a ReadOnly policy? SSO users can be assigned multiple sets of privileges. For example, if an SSO user is assigned the ReadOnly permission set and the PowerUser permission set, the user can switch between the two permission sets when necessary.

0

Thanks Riku. 1 I can't set policies for SSO users like in IAM anymore, right? 2 May I grant ReadOnly to all SSO users, create IAM role, let SSO user assume role when they need?

answered 3 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content