A platform team wants every developer to manage their own IAM roles, but no role a developer creates may exceed a defined permission ceiling. Which mechanism enforces this ceiling on self-service role creation?
A.Service control policies (SCPs)
SCPs restrict the whole account/org level, not specifically delegated role creation.
B.Permissions boundaries
Correct. Boundaries are the mechanism for safe self-service role management.
C.Resource-based policies
Resource policies control access to specific resources, not role creation ceilings.
D.Session policies
Session policies constrain temporary sessions, not role permission limits.
Why this answer
Permissions boundaries set the maximum permissions an identity-based policy can grant — a created role is effective only within its boundary, enabling delegated role creation with a hard ceiling. SCPs apply at the org/account level to all principals, not per-created-entity.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM Deep Dive practice session.
Practice IAM Deep Dive