Manage access

Permission sets and assignments

A permission set is a name and its AWS managed policies, as in IAM Identity Center. Assigned to a person or a group on an account, it becomes an IAM role in that account, named shonin-<Shonin org>-<permission set>.

#Create a permission set

Ask the Assistant, with the ARN of each AWS managed policy:

Create a permission set ReadOnly with arn:aws:iam::aws:policy/ReadOnlyAccess
Create a permission set Developer with arn:aws:iam::aws:policy/PowerUserAccess

Changing the policies of a permission set changes them on every account where it is assigned.

#Assign it

An assignment is a person or a group, a permission set and an account:

Assign ReadOnly to bob@acme.example on the accounts staging and production

Shonin prepares the account by itself; it can take a few minutes. Name the accounts every time: Shonin never assigns on every account by default. Removing the last assignment of a permission set on an account removes its role from that account.

Deleting a permission set removes every assignment.

#Which accounts

A Shonin org assigns permission sets on the accounts of the AWS organization it owns, and on the accounts other Shonin orgs delegated to it. On delegated accounts it works once the delegation is accepted: if an assignment fails because the installation does not trust it yet, try again in a few minutes.

#Management account

You can assign permission sets on the management account of your AWS organization, like on any other account. Whoever has an administrator permission set there controls the whole AWS organization. Opening it needs a code from an authenticator app or a backup code: a code by email is not accepted.

#Sessions

A console session or a set of Access keys lasts one hour. Profiles written by the shonin command last 8 hours. See Console access and Command line and SDKs.