A company gives application developers self-service access in 20 AWS accounts. Developers must be able to create IAM roles for their own Lambda functions and ECS tasks without waiting for a central team. The security team requires that every role a developer creates can never have more permissions than a fixed set (Amazon S3, DynamoDB and CloudWatch Logs), and that developers cannot create an administrator role or remove the restriction from a role to escape it.