Define a PermissionBoundaries policy and a DeveloperBoundary attached to the CreateAndManageUsers role

Why the Answer Is Correct

The requirement has three parts: the DevOps team must create IAM users with any level of permissions, the developers must also be able to create IAM users, and developers must not be able to grant new users excessive permissions. The mechanism that separates the ability to act from the ability to delegate is the IAM permissions boundary, because a boundary caps the maximum permissions a principal can hold and is evaluated alongside identity-based policies so that the effective permissions are always within it. An IAM policy named PermissionBoundaries is therefore created within each account, configured to specify the maximum permissions a developer can grant to a new IAM user (C). This is precisely the use AWS recommends for restricting delegated administrators such as developers, since the boundary limits what any user created by a developer may receive no matter what policies the developer attaches. A second policy named DeveloperBoundary is then created, configured to allow developers to create IAM users and to assign policies to those users only if the developer includes the PermissionBoundaries policy as the permissions boundary, and it is attached to the CreateAndManageUsers role so the developers actually inherit it (E). Because both boundaries are enforced by IAM and cannot be overridden by any allow, a developer cannot exceed the defined maximum, while the DevOps team, who are not bound by the boundary, retains unrestricted ability. Ky_24 and Impromptu both reasoned this way, and ArunRav noted that combining C with E enforces the boundary on delegated users. C and E are the correct combination.

Why the Other Options Are Wrong

A creates an SCP in the organization denying users the ability to create and modify IAM users, attaches it to the organization root, and attaches the CreateAndManageUsers role to developers. As Impromptu pointed out, an SCP denying the creation and modification of IAM users applies to every principal beneath it, so both the DevOps team and the developers would be prevented from creating IAM users at all, contradicting the explicit requirement that both groups must be able to create them. uncledana favored A on the theory that it provides control at the organizational level for non-DevOps users, but it cannot distinguish between the two groups and so blocks the DevOps team as well. B creates an SCP that grants users with the DeveloperBoundary policy the ability to create and modify IAM users and configures it to require the PermissionBoundaries policy on any new IAM user. This conflates two different mechanisms: an SCP is an authorization guardrail that can only subtract permissions and cannot grant them, and it has no ability to require that a permissions boundary be attached to a newly created user. Impromptu noted it would also prevent the DevOps team from creating users with any level of permissions. D configures the PermissionBoundaries policy to allow users who have that policy to create new IAM users. This inverts the policy's purpose: rather than capping what a developer may grant, it would grant creation rights to anyone holding the policy, so it does not limit excessive permissions and leaves the arbitrary-permission path open. C and E are correct.

Community Comment Notes

Community voted C,E (92). Ky_24 identified the two requirements precisely, that both the DevOps team and developers should be able to create IAM users, and that developers should be restricted from granting excessive permissions to those users. ArunRav explained the combination, that the SCP in A denies access to everyone without addressing the PermissionBoundaries policy, whereas combining C and E applies the boundary to what a developer-created user can receive. Impromptu gave a succinct elimination of every alternative, that A would prevent anyone including the DevOps team from creating users, that B would prevent the DevOps team from creating users with any level of permissions, and that C would create the boundary correctly. uncledana favored A and E, preferring the organizational-level SCP, which reflects a real design option but does not satisfy the requirement that the DevOps team retain unrestricted user creation. No alternative received majority support.