AWS IAM Identity Center
Status: Final
AWS IAM Identity Center (formerly AWS Single Sign-On) provides centralized access management across multiple AWS accounts in an AWS Organization. It is the recommended approach for multi-account AWS environments over per-account IAM users.
Architecture
Identity Source (Entra ID / Okta / built-in)
│
▼
IAM Identity Center
├── User Portal (https://<your-domain>.awsapps.com/start)
├── Permission Sets (map to IAM roles in each account)
└── Account Assignments (user/group → permission set → account)
Identity Sources
| Source | How it works | Notes |
|---|---|---|
| IAM Identity Center built-in | Local user directory | Simple but no external IdP |
| Entra ID (SCIM + SAML) | SCIM provisions users; SAML authenticates | Most common enterprise config |
| Okta (SCIM + SAML) | Same pattern | |
| External SAML IdP | SAML only (no SCIM) | Manual provisioning |
Permission Sets
A Permission Set is a template that creates an IAM role in a target account:
- Can reference AWS managed policies (e.g.,
AdministratorAccess) - Can reference inline policies
- Duration: configurable (max 12h for sessions)
When a user accesses an account through Identity Center, they assume the IAM role created by the Permission Set in that account.
Attack Surface
| Attack | Condition | Impact |
|---|---|---|
| Compromise Identity Center admin | sso:* permissions | Assign AdministratorAccess to attacker user across all accounts |
| SAML IdP compromise | Federated auth via SAML | Golden SAML → access any account/permission set |
| SCIM token theft | SCIM provisioning token | Add attacker user or modify group membership |
| Permission Set misconfiguration | AdministratorAccess assigned too broadly | Privilege escalation |
| Session token theft | Portal session cookie | Impersonate user across all assigned accounts |
Telemetry
AWS CloudTrail in the management account logs Identity Center events:
sso:CreateAccountAssignment,sso:DeleteAccountAssignmentsso:ProvisionPermissionSet- User portal logins:
sso-oauth:CreateTokenWithIAM
Cross-Links
| Topic | Link |
|---|---|
| AWS IAM Overview | aws-iam-overview |
| AWS STS | aws-sts |
| Golden SAML | golden-saml |