IAM Identity Center
Identity Center manages workforce access to AWS accounts and supported applications. It is not a replacement for every application-customer identity system. Start with IAM and policy evaluation.
Identity versus authorization
Choose the identity source: Identity Center directory, supported Active Directory or an external IdP. Federation handles authentication; SCIM can provision users/groups but does not by itself grant AWS account access.
Permission sets define access configuration provisioned into target accounts. Assignments connect a user/group, permission set and account. Provisioning/assignment is asynchronous; wait for success before concluding the user has access. Account instances and organization instances have different capabilities; check the deployment type before planning multi-account administration.
Sandbox access exercise
Prerequisites: an approved Identity Center administrator, a sandbox account and a test group. Do not modify production access to learn this workflow.
- Create a tightly scoped permission set through the console or documented SSO Admin API. Set the session duration consciously.
- Assign the test group to the sandbox account and wait for provisioning/assignment completion.
- Configure a CLI SSO profile and log in as the test user.
- Check
aws sts get-caller-identity, then test one permitted read and one deliberately denied operation. - Inspect the provisioned role and audit events with an administrator; verify access comes from the intended assignment rather than an unrelated role.
- Remove the test assignment and dedicated permission set only after reviewing impact. Existing sessions require separate lifetime/revocation consideration.
The creation API uses top-level Name and InstanceArn; permission-policy attachment is a separate operation. Do not use an invented --permission-set JSON argument.
Operational decisions
Define MFA, IdP outage behavior, emergency access, joiner/mover/leaver ownership and periodic access review. A short session lifetime alone does not replace incident revocation. Protect break-glass access independently and test it without weakening normal federation.
Identity Center is offered at no additional charge, but connected services and advanced analysis features may be billed separately.