AWS IAM Identity Center

Manage workforce access with single sign-on, permission sets, and temporary credentials.

https://cybr.com ↗ Christophe Limpalair ↗

What is IAM Identity Center?

IAM Identity Center is AWS’s recommended approach to managing workforce access instead of using IAM users. Federated identities let your team sign in with existing work accounts rather than creating separate AWS logins.

Connect to a central identity provider (IdP), such as your corporate directory, or use the IAM Identity Center directory.
Define access in one place using permission sets, which provision IAM roles in your assigned AWS accounts.
Let users single sign-on (SSO) to the AWS accounts and roles they are authorized to access.

Why avoid IAM users for workforce access?

Single-account scope: IAM users exist only in the AWS account where they are created. Cross-account access requires roles and trust relationships that you manage.
More credentials to manage: Separate usernames and passwords add overhead even when you already have a corporate directory.
Long-term credentials: IAM user access keys do not expire automatically. Forgotten or leaked keys can remain usable until you deactivate or delete them.

Why Identity Center is better

One login for your assigned accounts: Users access their authorized AWS accounts and roles through SSO with their existing work credentials.
Centralized access control: Define who can access what using permission sets. Identity Center automatically provisions the corresponding IAM roles in assigned accounts.
Temporary credentials: Users obtain short-term role credentials on demand. Those credentials expire automatically instead of remaining valid indefinitely.

Pro tip: For emergency use only (such as an Identity Center outage), preconfigure IAM users and roles that do not depend on Identity Center or your identity provider. Protect them with hardware MFA, alert on every use, and test the procedure periodically. AWS break-glass guidance ↗

How it works

From permission sets to provisioned account access

Getting started

Configure your identity source
Use Identity Center’s built-in directory, Active Directory, or an external IdP. Use an organization instance for multi-account AWS access.
Create permission sets
These are collections of policies that define what your users can do. Set the session duration and grant only the permissions they need.
Assign users or groups to accounts
Map users or groups to your AWS accounts with permission sets. Prefer group assignments to simplify ongoing access management.
Configure your AWS CLI
Use AWS CLI v2 to configure an SSO profile, then sign in to obtain temporary access.

Behind the scenes

An IAM role is created in the target account: Assigning a permission set provisions an IAM role in the selected account. Its name follows the pattern AWSReservedSSO_<PermissionSetName>_<UniqueSuffix>.
The trust relationship is configured: Identity Center configures the role’s trust policy and SAML provider so authorized users can assume the role. Manage these resources through Identity Center, not by manually editing them.
Users can SSO into that account: A user signs in to the AWS access portal and selects an assigned account and role. They receive temporary credentials for the corresponding role in the target account.

A better approach to users in the cloud

CLI commands

Configure credentials

Follow the prompts to configure your SSO session, select an account and role, and save a named profile.

aws configure sso --profile myprofile

Login or reauthenticate

Sign in and cache an SSO access token. The CLI uses that session to obtain temporary role credentials; reauthenticate when the SSO session expires.

aws sso login --profile myprofile

Pro tip: A tool like Granted can make managing multiple CLI profiles easier.

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

Use this Cybr cheat sheet as reference: AWS IAM Identity Center
Source: https://cybr.com/cheat-sheets/identity-center/

My goal: Explain workforce access

Explain how IAM Identity Center connects an identity source, permission sets, account assignments, and temporary role credentials. Compare this with IAM users and distinguish an SSO access token from AWS role credentials. Ask about my experience and walk through a console and CLI sign-in example.

Use the included reference material even if you cannot open the source URL. Ask for missing context rather than inventing my environment. Explain assumptions. For version-sensitive service behavior or commands, consult current official documentation when available, cite it, and explain any differences from this reference. If you cannot verify something, say so.

Reference material from the cheat sheet (structured text or a curated summary):

{
  "intro": "IAM Identity Center is AWS’s recommended approach to managing workforce access instead of using IAM users. Federated identities let your team sign in with existing work accounts rather than creating separate AWS logins.",
  "overview": [
    {
      "lead": "Connect to a central identity provider (IdP)",
      "text": ", such as your corporate directory, or use the IAM Identity Center directory."
    },
    {
      "lead": "Define access in one place",
      "text": " using permission sets, which provision IAM roles in your assigned AWS accounts."
    },
    {
      "lead": "Let users single sign-on (SSO)",
      "text": " to the AWS accounts and roles they are authorized to access."
    }
  ],
  "comparisons": [
    {
      "title": "Why avoid IAM users for workforce access?",
      "points": [
        {
          "title": "Single-account scope",
          "text": "IAM users exist only in the AWS account where they are created. Cross-account access requires roles and trust relationships that you manage."
        },
        {
          "title": "More credentials to manage",
          "text": "Separate usernames and passwords add overhead even when you already have a corporate directory."
        },
        {
          "title": "Long-term credentials",
          "text": "IAM user access keys do not expire automatically. Forgotten or leaked keys can remain usable until you deactivate or delete them."
        }
      ]
    },
    {
      "title": "Why Identity Center is better",
      "points": [
        {
          "title": "One login for your assigned accounts",
          "text": "Users access their authorized AWS accounts and roles through SSO with their existing work credentials."
        },
        {
          "title": "Centralized access control",
          "text": "Define who can access what using permission sets. Identity Center automatically provisions the corresponding IAM roles in assigned accounts."
        },
        {
          "title": "Temporary credentials",
          "text": "Users obtain short-term role credentials on demand. Those credentials expire automatically instead of remaining valid indefinitely."
        }
      ]
    }
  ],
  "setup": [
    {
      "title": "Configure your identity source",
      "text": "Use Identity Center’s built-in directory, Active Directory, or an external IdP. Use an organization instance for multi-account AWS access."
    },
    {
      "title": "Create permission sets",
      "text": "These are collections of policies that define what your users can do. Set the session duration and grant only the permissions they need."
    },
    {
      "title": "Assign users or groups to accounts",
      "text": "Map users or groups to your AWS accounts with permission sets. Prefer group assignments to simplify ongoing access management."
    },
    {
      "title": "Configure your AWS CLI",
      "text": "Use AWS CLI v2 to configure an SSO profile, then sign in to obtain temporary access."
    }
  ],
  "behind": [
    {
      "title": "An IAM role is created in the target account",
      "text": "Assigning a permission set provisions an IAM role in the selected account. Its name follows the pattern AWSReservedSSO_<PermissionSetName>_<UniqueSuffix>."
    },
    {
      "title": "The trust relationship is configured",
      "text": "Identity Center configures the role’s trust policy and SAML provider so authorized users can assume the role. Manage these resources through Identity Center, not by manually editing them."
    },
    {
      "title": "Users can SSO into that account",
      "text": "A user signs in to the AWS access portal and selects an assigned account and role. They receive temporary credentials for the corresponding role in the target account."
    }
  ],
  "commands": [
    {
      "label": "Configure credentials",
      "code": "aws configure sso --profile myprofile",
      "text": "Follow the prompts to configure your SSO session, select an account and role, and save a named profile."
    },
    {
      "label": "Login or reauthenticate",
      "code": "aws sso login --profile myprofile",
      "text": "Sign in and cache an SSO access token. The CLI uses that session to obtain temporary role credentials; reauthenticate when the SSO session expires."
    }
  ],
  "sources": [
    {
      "label": "What is IAM Identity Center?",
      "href": "https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html"
    },
    {
      "label": "Permission sets",
      "href": "https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html"
    },
    {
      "label": "Configure AWS CLI SSO",
      "href": "https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html"
    }
  ]
}

More cheat sheets