Single Sign-On with IAM Identity Center

As a company grows, giving every employee an IAM (Identity and Access Management) user in every account becomes a nightmare. People leave, roles change, and passwords sprawl across dozens of accounts.

IAM Identity Center (formerly AWS SSO) solves this by giving your workforce one place to sign in and reach every account they are entitled to. Identities live in a central directory, not scattered as long-lived IAM users.

IAM Identity Center is AWS's service for centralized workforce single sign-on across multiple accounts in an AWS Organization.

• It sits at the organization level, managed from the management or a delegated account.
• Users get a personalized access portal listing only the accounts and roles they may use.
• It can use its own built-in directory or connect to an external one.

Identity Center can draw users from three kinds of identity source:

• The built-in Identity Center directory for small teams.
• Active Directory (self-managed or AWS Managed Microsoft AD).
• An external IdP (identity provider) such as Okta or Entra ID via SAML.

You choose one source per Identity Center instance. Changing it later is disruptive, so pick carefully.

A permission set is a reusable bundle of IAM permissions that Identity Center turns into an IAM role inside each target account.

• Define a permission set once (for example, ReadOnly or Billing Admin).
• Assign it to a user or group for specific accounts.
• Identity Center provisions the matching role automatically in those accounts.

When a user signs in to the access portal, they authenticate once against the identity source. Identity Center then federates them into the chosen account by issuing temporary credentials through STS (Security Token Service) for the permission set they pick.

No long-term access keys are created. When the session expires, access ends automatically.

Manage access by groups, not individuals. Assign a group plus a permission set to a set of accounts, and every member inherits that access.

• Add a new hire to the group, and they instantly get the right access.
• Remove someone, and access disappears everywhere at once.

This keeps least privilege manageable as teams change.

Identity Center supports ABAC (attribute-based access control). User attributes such as department or cost center flow into AWS as session tags.

Your IAM policies can then reference those tags in conditions, so one permission set can grant different access depending on who the user is. This reduces the number of permission sets you must maintain.

You control how long a portal session lasts before re-authentication is required. Shorter sessions reduce the risk window if a device is stolen.

Identity Center can enforce MFA (multi-factor authentication), either always or only for risky sign-ins, adding a strong second factor to workforce access.

Running Identity Center from the Organizations management account concentrates risk. AWS lets you delegate day-to-day administration to a separate member account.

This follows the best practice of keeping the management account nearly empty and using purpose-built accounts for security tooling.

Beyond AWS accounts, Identity Center can be the SSO front door for SAML-enabled cloud applications and AWS-managed apps.

One login gives employees both their AWS console access and their business apps, all governed by the same groups and MFA rules.

Reach for Identity Center whenever you have more than a couple of accounts and human users who need console or CLI access.

• It replaces per-account IAM users for people.
• IAM roles still handle machine and service access.

On the exam, "centralize workforce login across many accounts" almost always points to IAM Identity Center.

Test your grasp of Identity Center.

You learned how IAM Identity Center centralizes workforce SSO across an organization.

• One identity source feeds many accounts.
• Permission sets become roles in each account.
• Access is granted to groups and delivered as temporary credentials with MFA.

It replaces sprawling IAM users for human access.