Create an IAM role named procurement-manager-role in all AWS accounts in the organization. Add the

PowerUserAccess managed policy to the role. Apply an inline policy to all IAM users and roles in every AWS

account to deny permissions on the AWSPrivateMarketplaceAdminFullAccess managed policy.

Create an IAM role named procurement-manager-role in all AWS accounts in the organization. Add the

AdministratorAccess managed policy to the role. Define a permissions boundary with the

AWSPrivateMarketplaceAdminFullAccess managed policy and attach it to all the Developer roles.

Create an IAM role named procurement-manager-role in all the shared services accounts in the organization. Add

the AWSPrivateMarketplaceAdminFullAccess managed policy to the role. Create an organization root-level SCP to

deny

permissions to administer Private Marketplace to everyone except the role named procurement- manager-role.

Create another organization root-level SCP to deny permissions to create an IAM role named procurement-manager-

role toeveryone in the organization.

Create an IAM role named procurement-manager-role in the AWS accounts that will be used by Developers. Add

the AWSPrivateMarketplaceAdminFullAccess managed policy to the role. Create an SCP in Organizations to deny

permissions to administer Private Marketplace to everyone except the role named procurement-manager-role. Apply

the

SCP to all the shared services accounts in the organization.