I'm responsible for tightening access because several colleagues currently have overly broad administrator policies. Their required access is limited to managing users and groups in IAM Identity Center and uploading files to a specific S3 bucket, and they work entirely through the AWS Management Console.
Everyone signs in through IAM Identity Center using Entra ID, so I can't simply create a local test user that will authenticate the same way. I'm also a full administrator, and adding myself to the restricted group could remove my admin access, forcing someone else to restore it whenever I need to test a change or review CloudTrail. What's the safest and most practical way to validate these permissions without affecting my administrator access?
3 Answers
Use a separate test identity rather than changing your administrator identity. A dedicated browser profile or container can keep the test SSO session separate from your normal session, making it easier to switch between identities without constantly logging out. Make sure the test identity is assigned only the same permission set as the target users.
Where possible, define the policies and permission sets with infrastructure as code and validate them before deployment. Tools such as policy simulators or policy-analysis tools can catch broad or unintended permissions, but you should still perform a small set of real console tests because permissions can affect what the console displays and which workflows are usable. An assumable test role is also useful for validating the underlying permissions, although it won’t perfectly reproduce every SSO user experience.
For IAM Identity Center, create a dedicated permission set with the proposed permissions and assign it to your own test identity or a separate test account. You can then switch into that permission set in the console and verify the actual user and group workflows while keeping your permanent administrator assignment intact.
That sounds like the best fit for our setup. I’ll use a separate SSO identity and assign it the restricted permission set instead of modifying my administrator access.