IAM identity Center SSO Demo

This lesson demonstrates how to enable and configure AWS IAM Identity Center (formerly AWS SSO), choose an identity source, create users and groups, build permission sets, and assign those permission sets across multiple AWS accounts. By the end you’ll know how Identity Center centralizes access and provisions IAM roles in member accounts. Before you begin: if the IAM Identity Center service shows an “Enable IAM Identity Center” button, click it to activate the service for your AWS Organization. After enabling, open Settings to tailor Identity Center for your environment.

​

Access portal and identity source

The Access portal URL is the user-facing sign-in page for federated users. Users open that portal, authenticate with their assigned credentials, then select the AWS account and role (permission set) to assume. In Settings you can change the identity source under Actions. Identity Center supports three options:

• Identity Center directory (create and manage users/groups inside AWS)
• Active Directory (AD Connector or AWS Managed Microsoft AD)
• External identity provider (SAML / OIDC)

Choose where identities are stored and managed. If you use the Identity Center directory, create users and groups inside AWS. If you select an external IdP or Active Directory, user and group lifecycle management happens on that external system.

​

Users and groups (Identity Center directory)

When using the Identity Center directory, users and groups you create here are separate from IAM users inside each AWS account. Identity Center is the central identity store; permission sets are assigned to those identities to control cross-account access. Steps to create users:

1. Open Users → Add user.
2. Provide name and email address (an invitation email is sent).
3. Optionally add users to groups for easier bulk assignment.
4. After accepting the invitation, users set their password and can sign in via the Access portal.

For this demo we create two users: user1 and user2. The invitation email contains an Accept invitation link for first-time registration (password setup and initial sign-in). After registration, the Users console lists the accounts and statuses. You can also enforce MFA and manage additional attributes from this view.

​

Permission sets — centralized role templates

Permission sets in Identity Center are templates that map to IAM roles provisioned in target AWS accounts. A permission set bundles one or more IAM policies (AWS managed or custom) to define what the federated role can do. Create a permission set:

• Use a preconfigured template (e.g., AdministratorAccess, ViewOnlyAccess), or
• Create a custom permission set and attach managed and/or inline policies.

In this demo we create two permission sets:

• S3FullAccess — attaches the AmazonS3FullAccess managed policy.
• ViewOnlyAccess — uses the AWS ViewOnlyAccess template.

When selecting managed policies, search by name (e.g., “s3”) to find AmazonS3FullAccess or AmazonS3ReadOnly. After creating a permission set, the console displays the permission set and its ARN. The status may show “Not provisioned” until the permission set is assigned to at least one account.

​

Assign permission sets to accounts and users

Identity Center enumerates the AWS accounts in your Organization so you can assign permission sets to users or groups across multiple accounts. To grant user1 S3 full access across both accounts:

1. Open the AWS accounts list in Identity Center.
2. Select both accounts, then choose “Assign users or groups”.
3. Pick user1, choose the S3FullAccess permission set, and complete the assignment wizard.

The console shows the chosen accounts and permission sets during the workflow. During the assignment flow you can select multiple permission sets and confirm provisioning. Use the console steps (Cancel, Previous, Next) to navigate or create new permission sets inline.

​

Sign in as federated user and verify access

Copy the Access portal URL from Settings and open it in a new tab. Sign in as user1. The portal lists accounts available to the user and the roles (permission sets) assigned to each. user1 should see both accounts with S3 Full Access. Switch to Account two and open the S3 console to create a bucket. Because the S3FullAccess permission set was assigned to Account two, the federated role can create buckets.

​

Assign different permissions for another user

As an example of granular access control, assign user2:

• S3FullAccess only on Account two
• ViewOnlyAccess on Main

This configuration lets user2 create buckets in Account two but restricts them to view-only actions in Main. When user2 attempts to create a bucket in Main, they will receive an error indicating the missing s3:CreateBucket permission — confirming the ViewOnlyAccess permission set is enforced. When user2 switches to Account two (where they have S3FullAccess), they can successfully create a bucket.

​

Quick mapping: users, accounts, permission sets

​

Summary and best practices

• IAM Identity Center centralizes identity management or integrates with external IdPs to avoid creating separate IAM users in each account.
• Permission sets define sets of IAM policies that Identity Center maps to IAM roles provisioned in target accounts.
• Assign permission sets to users or groups at the account level to give precise, auditable cross-account access.
• Use groups and permission sets to simplify large-scale access management.
• Monitor provisioning status in the console and allow a short time for IAM role provisioning to complete.

For more details and advanced configurations, see:

• AWS IAM Identity Center (AWS SSO) documentation: https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html
• AWS Organizations: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html

I hope this walkthrough clarified how to configure IAM Identity Center and use permission sets to manage access across multiple AWS accounts.