Account access manager
What is account access manager?
Account access manager lets you assign AWS account access to users and groups in your IAM Identity Center organization instance. You assign access using the IAM roles in your AWS accounts. You can use account access manager alongside IAM Identity Center permission sets or on its own. Both account access manager and IAM Identity Center permission sets use the users and groups that you synchronized from your identity source or created directly in IAM Identity Center.
Why use account access manager?
Account access manager enables you to assign your existing IAM roles to the users and groups you have synchronized into IAM Identity Center from your corporate source of identities. Using your existing IAM roles gives you extra flexibility to tailor user access, including:
-
Configure IAM role tags and use session tags for attribute-based access control (ABAC).
-
Configure IAM role trust policy to restrict role assumption, enforce network-based conditions, or use IdP-asserted claims as trust policy conditions.
-
Configure IAM role paths to group roles logically and simplify administration. For more information, see Configure IAM role paths to group roles logically and simplify administration
.
The following table compares the three account access options:
| IAM roles + account access manager | IAM Identity Center permission sets | IAM roles + IAM federation (direct role assumption) | |
|---|---|---|---|
| Best for | Custom IAM roles that vary across accounts | Uniform baseline human access such as read-only and admin provisioned as immutable IAM roles | Suitable for workloads |
| Scope | Multiple accounts (AWS organization) | Multiple accounts (AWS organization) | Per account |
| IAM role provisioning | Requires infrastructure as code (IaC) or manual provisioning through the AWS IAM console | Automatically provisioned | Requires infrastructure as code (IaC) or manual provisioning through AWS IAM and external IdP consoles |
| Role-to-identity mapping resides in | Account access manager | IAM Identity Center | External IdP |
| End user experience | Users access AWS accounts through the AWS account access portal URL after signing into AWS as IAM Identity Center users. | Users access AWS accounts through the AWS access portal after signing into AWS as IAM Identity Center users. | Users access AWS accounts through account-specific SAML applications (icons) in their IdP portal. |
| AWS CLI user experience |
|
User configures a profile including the desired account and role pair by typing aws configure sso. User types aws sso login to initiate a new session using a profile. If there is no active IAM Identity Center session, the user authenticates in a browser and authorizes access there. See the AWS IAM Identity Center User Guide for more details. | Custom integrations using AWS SDK credential providers |
Key capabilities
- Account access portal
-
Account access manager provides users with an account access portal where they can view and access the AWS accounts assigned to them through account access manager.
- CLI access
-
Your workforce can access AWS accounts through the AWS CLI using the aws login command after signing into AWS in a browser.
- Account access APIs
-
Account access manager has its own API namespace,
account-access, which is separate from the IAM API. You use this namespace in the AWS CLI and SDKs.
