AWS IAM Identity Center
Single sign-on and central workforce access management for AWS accounts and applications
Think of how a hotel works. Guests don't get a key cut for every room in the building; they check in at the front desk and get one card that opens exactly the rooms they're allowed into, for exactly as long as they're staying. IAM Identity Center is the front desk for your AWS organization. Each person signs in once, and their card (a permission set) opens the accounts their job requires, with temporary credentials that expire. Connect it to your company's directory, like Okta or Microsoft Entra ID, and when someone leaves the company, HR disables one account and every door in AWS locks behind them. No more IAM users with long-lived passwords taped to monitors.
IAM Identity Center (the successor to AWS SSO) is the recommended way to give humans access to AWS; IAM roles and users remain for workloads, not people. It lives in your organization and supports three identity sources: its own internal directory, Active Directory, or any SAML 2.0 identity provider such as Okta or Entra ID, with SCIM provisioning to keep users and groups in sync. Access is defined with permission sets: collections of IAM policies that get provisioned as roles in every member account a user is assigned to. Users sign in at the AWS access portal, pick an account and permission set, and receive temporary credentials; nothing long-lived is ever issued. Trusted identity propagation lets AWS managed applications such as Kiro, Amazon Quick, and Redshift share the verified user's identity with each other, so CloudTrail shows which person ran which query, not just which role. IAM Identity Center is also where you assign subscriptions for AWS applications like Kiro.
Key Capabilities
- One sign-in portal for all AWS accounts and AWS managed applications, with MFA enforced centrally
- Permission sets map job roles to IAM policies and provision as roles across every member account automatically
- Connects to Active Directory or a SAML 2.0 identity provider such as Okta or Entra ID, with SCIM user and group sync
- Trusted identity propagation passes the real user's identity between applications like Kiro, Amazon Quick, and Redshift for per-user CloudTrail audit trails
- Issues only temporary credentials, so there are no long-lived access keys for people to leak
- Included at no additional charge; you pay only for the underlying resources your workforce uses
Gotchas & Constraints
Gotcha #1: permission set changes take a few minutes to propagate to member accounts; don't panic when access doesn't appear instantly. Gotcha #2: there's one Identity Center instance per organization, so delegate administration deliberately if the security team must own it. Constraints: requires AWS Organizations, and changing your identity source later is painful; pick your IdP before onboarding users.
A 120-person company runs 30 AWS accounts. Before: every developer had IAM users scattered across accounts, 400+ long-lived access keys floated around laptops and CI scripts, and offboarding meant hunting for keys for days. They connect Microsoft Entra ID as the identity source with SCIM sync, define four permission sets (ReadOnly, Developer, DatabaseAdmin, OrganizationAdmin), and assign people to accounts by group membership. Developers sign into the AWS access portal with their company login, get a temporary session, and never see a static key again. CloudTrail now attributes every action to a named employee. When an engineer resigns, disabling their Entra ID account cuts AWS access everywhere within minutes.
The Result
zero long-lived human credentials, offboarding reduced from days to one directory action, and auditors get a straight answer to 'who could touch production in March?'