or I should say, passing in the short name of

AWSReservedSSO_PowerUserAccess_bf7fc98648d51168

results in the full arn in the configmap which does not work