What is AWS IAM Identity Center?
AWS IAM Identity Center (formerly AWS SSO) provides centralized single sign-on for all AWS accounts and cloud applications. Users sign in once at the Identity Center portal and gain access to all assigned AWS accounts without needing separate IAM users in each account. AWS recommends the service as the preferred way to manage workforce access to AWS accounts and applications.
The service can be used free of charge and integrates seamlessly with AWS Organizations. Permissions are centrally defined through Permission Sets and assigned at the account level.
Core Features
- Central SSO Portal: One portal for access to all AWS accounts and applications
- Permission Sets: Reusable permission templates applied to accounts
- Identity Provider Integration: SAML 2.0 and SCIM for Microsoft Entra ID, Microsoft Active Directory, Okta, Google Workspace, and more
- CLI Access: Temporary credentials for AWS CLI and SDK through SSO authentication
- ABAC Support: Attribute-based access control using user attributes from the identity provider
- Multi-Region Replication: Increased resilience through replication of the Identity Center configuration
Typical Use Cases
Multi-Account Access: Developers access development, staging, and production accounts through a central portal. Permission Sets define which permissions apply in which account.
Hybrid Identity: Organizations with existing Microsoft Entra ID or Okta use SAML federation so employees can access AWS with their existing credentials without managing separate passwords.
Compliance and Audit: Centralized access management enables complete logging of all account access. CloudTrail captures every SSO sign-in for audit purposes.
Benefits
- Usable free of charge with no separate licensing fees
- One portal for all AWS accounts and applications
- No IAM users required in individual accounts
- Temporary credentials instead of long-lived access keys
Integration with innFactory
As an AWS Reseller, innFactory supports you with AWS IAM Identity Center: multi-account SSO setup, identity provider integration, Permission Set design, and migration from IAM users to centralized SSO.
Typical Use Cases
Frequently Asked Questions
What is AWS IAM Identity Center?
AWS IAM Identity Center (formerly AWS SSO) is a free service for centralized single sign-on across all AWS accounts in an organization. Users sign in once and gain access to all assigned accounts and applications.
Is IAM Identity Center free?
Yes, IAM Identity Center can be used free of charge. There are no separate charges for users, groups, or sign-ins. The service is integrated with AWS Organizations.
Can I use existing identity providers?
Yes, IAM Identity Center supports SAML 2.0 and SCIM for integration with external identity providers like Microsoft Entra ID, Microsoft Active Directory, Okta, and Google Workspace. Users and groups can be automatically synchronized.
When should you use IAM Identity Center instead of individual IAM users?
IAM Identity Center is recommended once you manage multiple AWS accounts or want employees to sign in centrally through an existing identity provider. AWS generally recommends it as the preferred way to manage workforce access to AWS, instead of individual IAM users per account.
How does CLI access work with IAM Identity Center?
Users sign in through the SSO portal and obtain temporary credentials for the AWS CLI and SDKs through it. This reduces the risk associated with long-lived access keys.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of AWS (official documentation). This page does not represent an offer by AWS.