Each permission set assigned to an account becomes an IAM role named AWSReservedSSO_<PermissionSet>_<suffix> in that account. Identity Center owns the role: you can't edit it in IAM. If every assignment is removed and later re-added, the role is recreated with a new suffix. Never pin the exact ARN in a policy: match it with a wildcard.

The role

	Value
Name	`AWSReservedSSO_<permission-set-name>_<unique-suffix>`
ARN	`arn:aws:iam::<account>:role/aws-reserved/sso.amazonaws.com/<region>/AWSReservedSSO_<name>_<suffix>`. There is no `<region>/` segment when the identity source is in us-east-1
Who can assume it	By default, only Identity Center users (that is how the permission set's session duration is enforced)
Max session on the role	12 hours
Editable in IAM	No: `Cannot perform the operation on the protected role …`. Change the permission set instead
Lifecycle	Created on the first assignment of the set to the account; deleted when the last assignment is removed

aws sts get-caller-identity from an SSO profile shows arn:aws:sts::<account>:assumed-role/AWSReservedSSO_<name>_<suffix>/<user name>.

Referencing the role safely

When a policy elsewhere must name a permission-set role (an S3 bucket policy, a KMS key policy, another role's trust policy), use the account as principal and match the role with ArnLike:

{
  "Effect": "Allow",
  "Principal": { "AWS": "arn:aws:iam::<account>:root" },
  "Action": "sts:AssumeRole",
  "Condition": { "ArnLike": {
    "aws:PrincipalArn": "arn:aws:iam::<account>:role/aws-reserved/sso.amazonaws.com/<region>/AWSReservedSSO_AdministratorAccess_*"
  } }
}

The wildcard keeps working after the suffix changes.

KMS key policies and EKS aws-auth ConfigMaps are where a stale ARN locks you out, because you need access to fix them. AWS recommends:

Keep at least one permanent assignment of that permission set in the account (for example, an admin group), so the role is never deleted.
Also name a role you created in IAM (assumable by the permission set, as above) in the key policy or ConfigMap, as a backdoor.
For EKS, prefer access entries over aws-auth.

Without a backup role you may need AWS Support to regain access.

Session lengths

Session	Default	Range	Set where
Account session (console or CLI role credentials) from a permission set	1 hour	1–12 hours	The permission set's Session duration. Changing it reprovisions every account using the set
AWS access portal session (how long a user stays signed in to the portal)	8 hours	up to 90 days	Identity Center settings → session duration
CLI	—	—	Role credentials refresh automatically while the SSO session (the portal sign-in) is valid. After that, run `aws sso login` again

AWS recommends keeping session durations no longer than the work needs.

How changes reach accounts

Console: editing a permission set reprovisions it to every account where it is assigned. A notification confirms it.
API and IaC: an assignment provisions the set when it is created, but later edits to the set are not pushed automatically. Call ProvisionPermissionSet (target one account, or ALL_PROVISIONED_ACCOUNTS). The concept page's statement that updates happen automatically describes the console flow.
Assignment creation is asynchronous: check DescribeAccountAssignmentCreationStatus. ConflictException means a previous write hasn't propagated; retry with backoff.
Organization instances need multi-account permissions turned on (the default, but optional for instances created since August 2026; enable with UpdateInstance).

Permission-set contents

A permission set can hold AWS managed policies, customer managed policy references (the policy must exist by that name in every assigned account), an inline policy and a permissions boundary. If you need custom trust policies, tags or paths, assign existing IAM roles with account access manager instead (reference/identity-center/permission-sets-and-access.md).