My friend asked me yesterday if I know what AWS is. And it’s not someone I only talk to once in a while. We literally talk every day. I guess I always refer to my employer as just Amazon, so “AWS” never comes up.

He recently acquired an app and needed to create a new AWS account, add a new user for his developer, and give him permissions for Lightsail (whatever that is). He managed to do the first two. The permissions part? Yep, he had no idea.

I’ve written about IAM before here. My goal yesterday was to help him get it done quickly, not necessarily in the most appropriate way.

---

IAM Identity Center is confusing (even if you know IAM)

I assumed he used “regular IAM,” so the plan was simple: find the user in IAM, attach some permissions, move on with life. But he said there wasn’t a user in there, even though his developer was able to log in to the console. He just had no access.

My first thought was: maybe IAM isn’t global and he’s in the wrong region. So I asked him to check the region list. Nope, IAM is global.

Then it clicked: he probably used IAM Identity Center. Which was confusing even for me the first time I tried it, and I can only imagine how confusing it is if you don’t already have the “permissions mental model” in your head.

He opened Identity Center and of course had to switch the region to us-east-1. There he found his user, and I thought it would be as simple as assigning permissions.

It wasn’t.

He kept sending me screenshots of what he sees and I had no idea where he should go next. At some point I realized I was just guessing, so I logged into my own account and tried it before telling him anything else.

---

The actual flow (and where AWS hides it)

What needed to happen first was creating a Permission Set, and only then attaching policies to it. I won’t rant about how terrible this experience was when I forgot to specify which resources to allow, and then the console refused to save my changes when I tried to fix it. But I managed to get it working on my side, and my friend created the same thing on his side following my instructions.

Then we hit the next problem: I still didn’t see any way to attach the permission set to the user.

So I went to my favorite friend ChatGPT Google (yep, I still Google stuff sometimes because I hate how long ChatGPT takes to think, but that’s another story).

Apparently the missing step is hidden under:

Multi-account permissions → AWS accounts

From there you select the AWS account, assign the group or user, attach the permission set, and save.

This whole process should be more streamlined. Why do I have to go to 3–4 different places to get one developer access to one service? If I didn’t know at least in theory what needs to happen, this would’ve been even more painful than it already was.

Do you have your own IAM stories? Reply to share!

Cheers!

Evgeny Urubkov (@codevev)