search

aws-samples / iam-identity-center-team

Open-source temporary elevated access solution for AWS IAM Identity Center.
https://aws-samples.github.io/iam-identity-center-team/
MIT No Attribution
249 stars 59 forks source link

OU approver policies are ignored if account approver policy exists #253

Open lukasgabi opened 4 weeks ago

lukasgabi commented 4 weeks ago

Describe the bug Approvers that are assigned on OU level don't seem to be able to approve requests for an account in the respective OU if there's an approver policy assigned to the account directly.

To Reproduce Steps to reproduce the behavior:

  1. Define approver policy on an account
  2. Define approver policy on this accounts OU
  3. Create a reqest in TEAM
  4. Any user that is approver at OU level is unable to approve or reject the request

Expected behavior This is not mentioned in the docs, however I'd expect either OU and account approvers to handle requests instead of the ones defined on the OU level being overridden.

Additional context Add any other context about the problem here.