We have 10+ accounts clustered under a single root account, all in one organization. Our ops personnel gets a user in the root account and can access any "sub" account in the organization if said user has the required permissions (assumeRole).

I struggle with giving our users the correct permissions (attaching a policy) because IAM is limited everywhere to 10 items:

We have more than 10 sub-accounts. I first tried to attach for each account directly to users, or to groups that give access to users, but I always hit the following limits:

  • Groups an IAM user can be a member of: 10
  • Managed policies attached to an IAM group: 10
  • Managed policies attached to an IAM user: 10 (undocumented)

In order to give users access to an arbitrary number of accounts I need to create up an individual policy for each user it seems. Is that the only way?

  • You have over ten organisations in the same account, or more than ten accounts under one organisation? – Tim Mar 12 at 18:27
  • I clarified the question. We have 10+ accounts. Thanks for spotting this. – arnuschky Mar 15 at 4:40
  • Without looking this up, you could consider asking AWS to raise the limit, or you could look at federating your login with an on-premise active directory if you have one. There may also be an obvious answer that someone else will come up with, your question isn't quite as clear as I'd like in terms of exactly what you're trying to achieve. – Tim Mar 15 at 6:32
  • Can you solve this by using a tree of OUs in your organisation and assigning the relevant polices via the OUs and accounts so they combine permissions as you want them? – Lunc Mar 15 at 12:51

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.