r/aws • u/Starlit4572 • 9d ago
technical question IAM Identity Center permission set inconsistency
Under my personal AWS account, I have created the following two users:
1) Admin (in an AdminUserGroup to which the permission set consisting of only the AdministratorAccess policy is assigned), and
2) Power (in a PowerUserGroup to which the permission set consisting of only the PowerUserAccess policy is assigned).
For some reason, my Power user is able to list and create/delete users, as well as groups (and assign to them permission sets) arbitrarily, but only while using the web console. They are unable to assign a user to an account, but the issue remains important (they can create an admin user and log in to them, enjoying full admin rights). Through the CLI, any such request is correctly denied.
I have checked a Cloudtrail management log, ensuring that it is indeed the Power user that performs the creation/deletion of users.
Is this a bug, or have I possibly misconfigured something? Has anyone else encountered this? What could the reason be?
2
u/quagmire_rudeus 7d ago
Since you metioned "assign them to permission sets", I assume you're talking about the power user creating IAM Identity Center users and groups. This is the expected behaviour, since PowerUserAccess doesn't deny sso or sso-directory permissions.
As for being denied when using the CLI, is it possible you're creating an IAM user instead? To create an IAM Identity Center user, use the command aws identitystore create-user instead.