Assign Access Policies

Environments are how you logically isolate teams from one another. While IAM access policies can be set for the entire account as well as the workspace level, the most common practice is to assign development team access at the environment level. It is common that an environment is created per team or application and the team is then assigned to the environment through an access policy:

Teams and roles must already exist to be able to assign access to an environment. Once both of the objects exist, the access is granted through an access policy:

As mentioned, access can be made more granular by going down to the workspace level. Learn more about IAM here.