We have 10+ accounts clustered under a single root account, all in one organization. Our ops personnel gets a user in the root account and can access any "sub" account in the organization if said user has the required permissions (assumeRole).
I struggle with giving our users the correct permissions (attaching a policy) because IAM is limited everywhere to 10 items:
We have more than 10 sub-accounts. I first tried to attach for each account directly to users, or to groups that give access to users, but I always hit the following limits:
- Groups an IAM user can be a member of: 10
- Managed policies attached to an IAM group: 10
- Managed policies attached to an IAM user: 10 (undocumented)
In order to give users access to an arbitrary number of accounts I need to create up an individual policy for each user it seems. Is that the only way?