Applying an IAM Policy to a Cloud Access Role

IAM policies can be attached to cloud access roles on the project level or the OU level.

When an IAM policy is attached to a cloud access role on the project level, Kion will create an IAM role on all the AWS accounts attached to the project. It will then attach the IAM policy to the role it just created. If it's a policy that doesn't already exist in the AWS account, it will be created.

Once the IAM policy is attached, the user will have the permissions assigned to the IAM role when they use the Cloud Access menu to log into an AWS account. One or more IAM policies can be attached to a single cloud access role. AWS limits the number of managed policies per role (the default quota is 10; for AWS commercial accounts, Kion syncs the quota from AWS Service Quotas), so you need to consolidate IAM policies if you attach more than your accounts allow. If the assigned policies exceed the quota, Kion shows an error that some IAM policies could not be attached.

You can also select an AWS permissions boundary for the role in the AWS Permissions Boundaries (Optional) field. The permissions boundary counts toward the same policy limit as the IAM policies selected for the role.

To learn how to apply an IAM policy to a cloud access role, see the Add a User Cloud Access Role article.