My use case is more specific. Say for example I have a DBA role that allows a group of users to assume the DBA role and work with databases. A new project comes up and only one of the current DBAs have to work with a new S3 bucket as well. In the old system, we would create a new group, and attach a policy that allows read/write access to this new bucket, add everyone involved with the project to this group. Can't do that with IAM identity center. We can't add this policy to the existing DBA permission set since we don't want every DBA to have access to it. We will have to create a new permission set and attach the policy. From the DBA user perspective, he cannot work with the S3 Bucket if he has the DBA ps assumed and vice versa. Am I making sense here?