The iam: PassRole Nightmare - 3 Weeks of My Life I Will Never Get Back

Short summary

An enterprise Bedrock Agent deployment failed due to an explicit deny on iam:PassRole in the organization's managed IAM policy. The solution was deploying via CloudFormation (which uses a service role with proper permissions) instead of the CLI, after a security review and 5-day change request. Enterprise IAM requires understanding the full policy evaluation chain: SCPs, permission boundaries, managed policies, and resource policies.

• •Explicit IAM denies cannot be overridden—even AdminAccess loses to explicit deny
• •CloudFormation uses a service role, bypassing user-level IAM denies for resource creation
• •Enterprise deployment requires architecture review upfront, not trial-and-error permission escalation

Generated with AI, which can make mistakes.