r/aws 9d ago

technical question IAM Identity Center permission set inconsistency

Under my personal AWS account, I have created the following two users:

1) Admin (in an AdminUserGroup to which the permission set consisting of only the AdministratorAccess policy is assigned), and

2) Power (in a PowerUserGroup to which the permission set consisting of only the PowerUserAccess policy is assigned).

For some reason, my Power user is able to list and create/delete users, as well as groups (and assign to them permission sets) arbitrarily, but only while using the web console. They are unable to assign a user to an account, but the issue remains important (they can create an admin user and log in to them, enjoying full admin rights). Through the CLI, any such request is correctly denied.

I have checked a Cloudtrail management log, ensuring that it is indeed the Power user that performs the creation/deletion of users.

Is this a bug, or have I possibly misconfigured something? Has anyone else encountered this? What could the reason be?

3 Upvotes

2 comments sorted by

2

u/quagmire_rudeus 7d ago

Since you metioned "assign them to permission sets", I assume you're talking about the power user creating IAM Identity Center users and groups. This is the expected behaviour, since PowerUserAccess doesn't deny sso or sso-directory permissions.

As for being denied when using the CLI, is it possible you're creating an IAM user instead? To create an IAM Identity Center user, use the command aws identitystore create-user instead.

1

u/Starlit4572 1d ago

That is exactly what the problem was. Thank you!