How would you design and curate AWS Permission Sets ?

[nitrocode]

1. Job Function ?
2. Team ?
3. None at all ?
4. Break glass only ?
5. Specific accounts ?
6. or with your model is identity the ingress into the other AWS accounts so no need to attach a permission set to any other account other than identity?
7. How about temporary access to permission sets?
8. Who would curate the permission sets?
9. Who would dole out access to the permission sets?
10. Combination of the above?
11. Anything you'd recommend that I'm not thinking of?
12. Any references for your positions?

Thanks,
RB

[osterman]

Thanks for the thoughtful set of questions!

This topic spans design decisions related to our commercial reference architecture, which we don’t cover under Free Tier Support.

We’re happy to help with individual technical questions, clarifications around our documentation, usage of specific components, or similar focused topics here. For broader architectural guidance, we recommend engaging through our Essential Support tier.