Skip to main content
In this lesson we’ll cover AWS IAM Identity Center (formerly AWS Single Sign-On) and how it centralizes identity and access management across multiple AWS accounts and applications. IAM Identity Center is often compared to IAM because both handle authentication and authorization, but they serve different purposes. IAM provides identity and permissions within a single AWS account. IAM Identity Center provides centralized workforce identity and access management across many accounts and applications, simplifying provisioning, auditing, and cross-account access.

​
Why centralized identity matters

Consider an organization with multiple AWS accounts:
  • Account one contains specific resources and users who need access.
  • Account two contains different resources and needs its own users.
  • Account three likewise requires separate users.
If Bob needs access to resources in accounts one, two, and three, you would traditionally create an IAM user for Bob in each account. As the number of accounts and employees grows, this per-account approach becomes difficult to manage. Operational challenges with per-account IAM user management:
  • Increased overhead: You must create and maintain the same user across multiple accounts.
  • Inconsistent permissions and configuration drift: Changes in one account must be manually replicated to others.
  • Harder auditing: You must inspect each account individually to determine access.
  • Time-consuming role and permission management: Roles and policies must be created and maintained in every account.
IAM Identity Center solves these problems by providing a centralized place to create or connect workforce identities and grant access across many AWS accounts and business applications.

​
Core concepts

  • Users: Workforce identities that need access.
  • Account assignments: Granting a user or group access to one or more AWS accounts.
  • Permission sets: Reusable collections of IAM policies that define what a user can do in an assigned account.
A schematic diagram of AWS IAM Identity Center showing permission sets, an AWS account icon, and an AD group inside the Identity Center boundary. To the right it shows a user assigned "PermissionSet1" in an AWS account and accessing a resource (chip icon).

​
Permission sets vs IAM roles

Permission sets are analogous to IAM roles or a bundle of IAM policies. You define permission sets inside IAM Identity Center (for example, a “ReadOnly” or “Admin” profile). When you assign a permission set to a user or group for a specific AWS account, IAM Identity Center provisions the necessary role in the target account so the user can sign in with those privileges. Key points:
  • Permission sets are reusable: assign the same set across multiple accounts.
  • Provisioning is automatic: IAM Identity Center creates and maps the roles in each account for you.
  • They map to IAM policies, so you can control fine-grained permissions.
For more detail, see AWS documentation on IAM Identity Center and permission sets:

​
Authentication and supported identity sources

IAM Identity Center handles authentication and authorization centrally and can integrate with external identity providers to simplify identity lifecycle management. Supported identity sources:
  • The built-in IAM Identity Center identity store.
  • Active Directory (including AWS Managed Microsoft AD).
  • External identity providers and SSO platforms such as Okta, OneLogin, and Microsoft Azure Active Directory.
  • Custom SAML 2.0 identity providers for business applications.
A diagram of AWS IAM Identity Center (SSO) showing a web browser connecting to the IAM Identity Center, which stores and retrieves user identities from Active Directory or a built-in identity store. The Identity Center then provides SSO access (keys) to the AWS Cloud, business cloud apps, and custom SAML 2.0–enabled apps.

​
Where IAM Identity Center provides access

IAM Identity Center supports SSO into:
  • The AWS Management Console across multiple accounts.
  • AWS-managed services that support SSO (for example, Amazon SageMaker Studio and Amazon Managed Grafana).
  • Custom SAML 2.0–enabled business applications and many cloud apps.

​
Benefits summary

  • Centralized administration: Create or connect identities once and manage access across many accounts.
  • Reduced configuration drift: Permission sets are reusable and consistently applied.
  • Improved auditing: Single place to review who has access to what.
  • Easier lifecycle management: Integrates with directory services to provision and deprovision access.
  • Cost: IAM Identity Center is provided at no additional charge; you pay only for the underlying resources used in target accounts.
Permission sets in IAM Identity Center represent the IAM policies that will be applied to a user when they access a given AWS account. Treat them as reusable permission profiles that map to roles provisioned inside each target account.

​
Resources and further reading

Watch Video