AWS IAM Identity Center
A single sign-on (SSO) service integrated with AWS Organizations that centrally manages access to multiple AWS accounts and business applications
Overview
AWS IAM Identity Center (formerly AWS SSO) is a service that provides single sign-on to multiple AWS accounts and business applications. Permission Sets allow you to declaratively define permissions for users and groups in each account, enabling large-scale access management that works in concert with your Organizations structure. Federation authentication leveraging your existing identity infrastructure is possible through integration with external IdPs (Okta, Azure AD, Google Workspace, etc.) that support SAML 2.0 and SCIM.
Limitations of IAM Users and How Identity Center Solves Multi-Account Authentication Challenges
As AWS usage grows, accounts multiply for environment isolation and security boundaries. Creating IAM users in each account requires managing credentials for every account-user combination, making password rotation and access key management a significant operational burden. Missed account deletions for departing employees become a breeding ground for security incidents. IAM Identity Center addresses this problem. Users log in to a portal with a single set of credentials and simply select from their assigned AWS accounts and roles to access the Management Console or CLI with temporary credentials. Long-lived access keys are not needed. Organizations that use Microsoft Entra ID as the identity source can automatically sync users and groups with SCIM provisioning. According to the user guide, a user disabled in the identity source cannot create new sign-in sessions, but an active access portal session remains, so revoking access involves separate steps such as removing permission set assignments.
Permission Set Design Strategy and Practicing Least Privilege
Permission Sets are the core concept of Identity Center's authorization management. A single Permission Set is a collection of IAM policies that defines "which permissions" a user or group has "in which account." For example, you can assign a "ReadOnlyAccess" permission set to the audit team across all accounts while restricting "AdministratorAccess" to only the SRE team in production accounts. Permission sets accept AWS managed policies, customer managed policies, inline policies, and other policy types. Session duration is set per Permission Set, and the user guide gives a default of 1 hour and a maximum of 12 hours (as of October 2026). An AWS managed policy or a customer managed policy can also be assigned as the permissions boundary of a permission set.
CLI/SDK Integration and Optimizing Developer Experience
Identity Center integrates natively with AWS CLI v2. Configuring an SSO profile with the aws configure sso command enables automatic retrieval of temporary credentials through browser authentication. By defining SSO profiles in ~/.aws/config, you can operate across multiple accounts simply by switching with the --profile option, eliminating the need to write access keys in .env files. IaC tools like Terraform and CDK also recognize SSO profiles, so the same authentication flow works when executing infrastructure code. For Organizations integration, the user guide recommends restricting access to the management account to as few people as possible, and describes the Delegated Administrator feature as a way to reduce the number of people who need that access. ABAC (Attribute-Based Access Control) is also supported, propagating user attributes (department, project name, etc.) as session tags and controlling access by matching them against resource tags.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS Organizations official page
- AWS IAM official page
- AWS Control Tower official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.