New featureMedium

IAM Identity Center now enables programmatic AWS account access for customer managed applications

IAM Identity Center allows customer managed applications to programmatically access AWS accounts on behalf of users, eliminating redundant sign-in prompts after external IdP authentication.

IAM Identity Center now enables customer managed applications to programmatically access AWS accounts on behalf of their users when they authenticate through an external identity provider (IdP). By configuring the IdP as a trusted token issuer (TTI) in IAM Identity Center, users can access their assigned AWS accounts and obtain temporary security credentials for their authorized roles without a separate authentication flow. This eliminates redundant sign-in prompts that previously required users to re-authenticate even after signing in through their external identity provider. This feature is available for organization instances of IAM Identity Center, and administrators must explicitly enable AWS account access for each customer managed application. Only management account administrators or delegated administrators can enable this capability, ensuring centralized governance over which applications can access account-level resources. The feature is available in all commercial AWS Regions, AWS GovCloud (US) Regions, and China Regions.

Read the original AWS announcement

Related articles and terms

AWS IAM Identity CenterA service that provides single sign-on to multiple AWS accounts and SaaS applicationsSingle Sign-On with AWS IAM Identity Center - Multi-Account Access ManagementAchieve single sign-on for multi-account environments and control access levels to each account with permission sets. Covers external IdP integration and ABAC usage.AWS IAMAn authentication and authorization service for securely controlling access to AWS resources, providing fine-grained access management through users, groups, roles, and policiesAmazon CognitoA service that provides authentication, authorization, and user management for web and mobile applicationsDesigning Identity and Access Management - Achieving Zero Trust Security with IAMLearn access management design techniques with AWS IAM, including the principle of least privilege, policy design, and achieving zero trust security through Cognito integration.