AWS IAM Identity Center

What it is

AWS IAM Identity Center connects your workforce users, meaning employees and contractors, to AWS accounts and AWS managed applications with single sign-onSSO (Single sign-on)Signing in once to reach many applications or accounts without signing in to each again. AWS IAM Identity Center provides single sign-on to AWS accounts and applications.Glossary entryClose. Users sign in once to an access portal and choose the account and role, or the application, they need. Administrators manage access centrally for every account in AWS Organizations. It was called AWS Single Sign-On until it was renamed on July 26, 2022, and it has no additional charge.

Choose IAM Identity Center when a question asks for central management of employee access to many AWS accounts, SSO with an existing corporate identity provider such as Okta or Microsoft Entra ID, or temporary credentials for people instead of IAM users.

Concepts

• Instances:
  • An organization instance is enabled in the Organizations management account (or managed by a delegated administrator). It is recommended and supports all features, including access to accounts.
  • Account instances exist only for AWS managed applications in a single account.
• Identity source: where users and groups live. There is one per organization:
  • The Identity Center directory (the default): create users and groups in Identity Center.
  • Active Directory: AWS Managed Microsoft AD, or self-managed AD through AD Connector.
  • An external identity provider, such as Okta or Microsoft Entra ID, using SAML 2.0SAML (Security Assertion Markup Language)An XML-based standard for passing sign-in information from an identity provider, such as Microsoft Entra ID or Okta, to a service. AWS accepts SAML 2.0 for single sign-on, directly in IAM or through IAM Identity Center.Glossary entryClose, with SCIM to provision users and groups automatically.
• Permission sets: templates of IAM policies, such as "DatabaseAdmin" or "ReadOnly". When you assign a group a permission set in an account, Identity Center creates the matching IAM role in that account, and users get temporary credentials for it.
• Attribute-based access controlABAC (Attribute-based access control)An access control approach that grants permissions by matching attributes, such as tags on a user or role and on a resource, instead of listing each resource. In AWS, ABAC uses tags in IAM policy conditions, so new resources with the right tags are covered without editing the policy.Glossary entryClose (ABAC): pass user attributes, such as department or cost center, into sessions and use them in policies.
• Access portal and CLI: users open accounts from the portal, or sign in from the CLI with aws configure sso.

Security, resilience, performance, and cost

• Security: no long-term credentials for people; MFAMFA (Multi-factor authentication)Signing in with two or more different kinds of proof, such as a password plus a code from a phone app or a security key. AWS recommends MFA for the root user and for every human user.Glossary entryClose; central access reviews; CloudTrail records sign-ins and changes.
• Resilience: a managed service; keep a break-glass path, such as protected root or emergency access, in case the identity provider is unavailable.
• Cost: no additional charge.

IAM Identity Center or another option?

If the requirement is	Choose
Employees sign in once to many AWS accounts	IAM Identity Center
Use Okta or Entra ID users for AWS access	IAM Identity Center with an external IdP and SCIM
Customers of our app sign up and sign in	Amazon Cognito
Federation into a single account with SAML	IAM SAML identity provider
Managed Active Directory in AWS	AWS Directory Service

Reverse mindmap: when the question points here

• Yes, when the question says
  • Single sign-on to all accounts in the organization→ leads to IAM Identity Center
  • Employees use corporate credentials for AWS→ leads to External IdP or AD as identity source
  • Replace IAM users with central access→ leads to IAM Identity Center
  • Formerly AWS SSO→ leads to IAM Identity Center
• Configure it
  • Same permissions in many accounts→ leads to Permission set assigned to a group
  • Sync users from Okta automatically→ leads to SCIM provisioning
  • Use existing AD users→ leads to AD Connector or AWS Managed Microsoft AD
  • Permissions by department→ leads to ABAC with user attributes
  • CLI sign-in for employees→ leads to aws configure sso
• No, when the question says
  • App customers sign in→ leads to Cognito

Key takeaways

• IAM Identity Center (formerly AWS SSO) gives workforce users single sign-on to AWS accounts and applications, at no charge.
• Use an organization instance in the Organizations management account; there is one identity source per organization.
• Identity sources: the Identity Center directory, Active Directory, or an external IdP with SAML and SCIM.
• Permission sets become IAM roles in each assigned account, giving users temporary credentials.
• Use Cognito, not Identity Center, for customer identities.

Sources

• IAM Identity Center User Guide: What is IAM Identity Center?
• IAM Identity Center User Guide: Organization and account instances
• IAM Identity Center User Guide: Manage your identity source
• IAM Identity Center User Guide: Microsoft AD directory
• IAM Identity Center User Guide: Provision users and groups using SCIM
• IAM Identity Center User Guide: Manage AWS accounts with permission sets
• IAM Identity Center User Guide: Attribute-based access control
• AWS CLI User Guide: Configuring IAM Identity Center authentication