title: What is the real benefit of AWS IAM permission boundaries?
body: <p>If a user in AWS is having <code>AdministratorAccess</code> policy attached, he has full AWS access for that account. But with permission boundaries attached to that user his access can be confined. For example say the user has permission boundaries set to <code>AmazonDynamoDBFullAccess</code>, then the full access is just confined to DynamoDB.</p>
  <p>What is real benefit of above approach, one could have just removed the <code>AdministratorAccess</code> policy and attached <code>AmazonDynamoDBFullAccess</code> to the user to achieve the same restrictions/permissions.</p>
  <p>Is there anything more to understand?</p>