Configure access to AWS accounts

Organization instances of IAM Identity Center are integrated with AWS Organizations. This enables you to centrally manage permissions across multiple AWS accounts without configuring access individually to each account.

The following table compares the account access management options that you should consider:

AWS account types

There are two types of AWS accounts in AWS Organizations:

For more information about AWS account types, see AWS Organizations Terminology and Concepts in the AWS Organizations User Guide.

You can also choose to register a member account as a delegated administrator for IAM Identity Center. Users in this account can perform most IAM Identity Center administrative tasks. For more information, see Delegated administration.

For each task and account type, the following table indicates whether the IAM Identity Center administrative task can be performed by users in the account.

*Refer to the best practices for delegated administration regarding user and group assignments to the management account.

Assigning AWS account access

You can use permission sets to simplify how you assign users and groups in your organization access to AWS accounts. Permission sets are stored in IAM Identity Center and define the level of access that users and groups have to an AWS account. You can create a single permission set and assign it to multiple AWS accounts within your organization. You can also assign multiple permission sets to the same user.

You can also use account access manager — an IAM feature — to assign existing IAM roles to IAM Identity Center users and groups in your organization's accounts. You can use account access manager on its own, or together with permission sets. Account access manager gives you access to the full IAM role feature set, including custom trust policies, role tags for ABAC, and configurable role paths.

For more information about permission sets, see Create, manage, and delete permission sets.

End-user experience

The AWS access portal provides IAM Identity Center users with single sign-on access to all their assigned AWS accounts and applications through a web portal. The AWS access portal is different from the AWS Management Console, which is a collection of service consoles for managing AWS resources.

When you create a permission set, the name that you specify for the permission set appears in the AWS access portal as an available role. Users sign in to the AWS access portal, choose an AWS account, and then choose the role. After they choose the role, they can access AWS services by using the AWS Management Console or retrieve temporary credentials to access AWS services programmatically.

To open the AWS Management Console or retrieve temporary credentials to access AWS programmatically, users complete the following steps:

For step-by-step guidance that you can provide to your workforce users, see Setting up and using the AWS access portal and Getting IAM Identity Center user credentials for the AWS CLI or AWS SDKs.

Enforcing and limiting access

When you enable IAM Identity Center, IAM Identity Center creates a service-linked role. You can also use service control policies (SCPs).

Delegating and enforcing access

A service-linked role is a type of IAM role that is linked directly to an AWS service. After you enable IAM Identity Center, IAM Identity Center can create a service-linked role in each AWS account in your organization. This role provides predefined permissions that allow IAM Identity Center to delegate and enforce which users have single sign-on access to specific AWS accounts in your organization in AWS Organizations. You need to assign one or more users with access to an account, to use this role. For more information, see Understanding service-linked roles in IAM Identity Center and Using service-linked roles for IAM Identity Center.

Limiting access to the identity store from member accounts

For the identity store service used by IAM Identity Center, users who have access to a member account can use API actions that require Read permissions. Member accounts have access to Read actions on both the sso-directory and identitystore namespaces. For more information, see Actions, resources, and condition keys for AWS IAM Identity Center directory and Actions, resources, and condition keys for AWS Identity Store in the Service Authorization Reference.

To prevent users in member accounts from using API operations in the identity store, you can attach a service control policy (SCP). An SCP is a type of organization policy that you can use to manage permissions in your organization. The following example SCP prevents users in member accounts from accessing any API operation in the identity store.

        {
            "Sid": "ExplicitlyBlockIdentityStoreAccess",
            "Effect": "Deny",
            "Action": ["identitystore:*", "sso-directory:*"],
            "Resource": "*"
        }

For more information, see Service control policies (SCPs) in the AWS Organizations User Guide.