I have a question about aws_ssoadmin_permission_set. Let’s consider a scenario where we have two AWS accounts, a development account, and a production account, both under the same Organizational Unit (OU) called “workloads”. Each account has different customer managed policies deployed using stack sets on OUs, meaning they are present in both the development and production accounts.

Let’s say we have two customer managed policies named “read-lambda” and “write-lambda”. Now, we have a developer named Joe who needs both of these policies in the development account. We attach them using the following Terraform code:

resource "aws_ssoadmin_customer_managed_policy_attachment" "example_read" {
    instance_arn = aws_ssoadmin_permission_set.example.instance_arn
    permission_set_arn = aws_ssoadmin_permission_set.example.arn
    customer_managed_policy_reference {
       name = "read-lambda"
       path = "/"
   }
}

resource "aws_ssoadmin_customer_managed_policy_attachment" "example_write" {
    instance_arn = aws_ssoadmin_permission_set.example.instance_arn
    permission_set_arn = aws_ssoadmin_permission_set.example.arn
    customer_managed_policy_reference {
       name = "write-lambda"
       path = "/"
   }
}

However, doesn’t this attach the policies to the permission set as a whole? Because if I use the following code to assign the permission set to a group in the development account:

resource "aws_ssoadmin_account_assignment" "account_assignment" {
  instance_arn       = var.identity_store_id
  permission_set_arn = aws_ssoadmin_permission_set.this.arn
  principal_id       = "some_group_arn"
  principal_type     = "GROUP"
  target_id          = var.development_account_id
  target_type        = "AWS_ACCOUNT"
}

This permission set becomes available in the development account. Do I need to create new permission sets if I want to attach different policies based on the account? Or is there another way to achieve this?