TCP #133: Permission sets belong in a pipeline, not in the Identity Center console
The controls-as-code system for permission sets: repo structure, CI/CD deployment, privilege review gates, and drift detection
You centralized identity. IAM Identity Center is your source of truth. Human access runs through federation, not static keys. That was the hard part, and you did it.
Then someone widened a permission set in the console during an incident, and nobody knows.
The permission set, which was scoped to read-only, now has write access because an engineer needed it at 2 a.m., and the console was right there. The change is live in every account to which the permission set is assigned. There is no pull request, no reviewer, no record of why. The access review three months from now will find it, or it will not.
Centralizing identity solved the problem of credential sprawl. It did not solve the sprawl of permissions inside the centralized system.
Why Console-Edited Permission Sets Undo the Work
The value of IAM Identity Center lies in the fact that access is defined in one place. That value evaporates the moment the one place is edited by hand.
A permission set is not a small object. It is a bundle of policies that applies to potentially dozens of accounts at once. A single console edit to a widely assigned permission set is one of the highest-blast-radius changes available in your entire AWS estate, and it is available to anyone with console access to the management account.
The cost is the same as that of any unversioned control. At audit time, you cannot show the history of who changed what and why. During an incident, you cannot tell whether a permission set is in its intended state or in the state someone left it months ago. And the privilege-escalation review that your compliance framework requires becomes impossible, because the thing you are reviewing changes underneath you without a trace.
You did the work to centralize. Managing permission sets by hand quietly gives it back.
How Teams Backslide After Centralizing
The backslide is not a decision. It is the path of least resistance reasserting itself.
