More detail
Assign the AdministratorAccess permission set to ryan in Prod, and Identity Center creates a role in Prod with that policy and lets ryan assume it.
Permission set
A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.
Think of it as: A job description that comes with the right keys in every building.
What to know for Level 0
- Assigning a permission set to someone in an account creates an IAM role there with those permissions, which they assume when they open that account.
- Assignments are per account, so one person can have broad access in Dev and read-only access in Prod: least privilege.