Permission Boundaries

Permission boundaries are AWS IAM policies that set the maximum permissions an IAM entity (user or role) can have, regardless of what identity-based policies grant. They prevent privilege escalation by ensuring that even if a developer grants themselves or a role additional permissions, those permissions cannot exceed what the boundary allows.

Permission boundaries are essential in delegation scenarios where teams manage their own IAM roles within security guardrails established by a central security team.