AWS IAM Support
AWS IAM Identity Center (SSO) setup.
IAM Identity Center gives people one sign-in and temporary credentials into every AWS account, so you can stop distributing long-lived IAM user keys. We connect your identity provider, design permission sets around jobs and move teams over without locking anyone out.
When You Need This
The situations where this work pays for itself.
Signs it is time
- People share IAM users or have separate users in each account
- You want sign-in through Microsoft Entra ID, Okta or Google Workspace
- Developers need CLI access without storing access keys
- Offboarding someone means hunting through accounts
- An audit asks for MFA and centrally managed access
What you get
- Identity Center configured as code where supported
- Permission sets and group assignments for each account
- A migration plan from IAM users with a break-glass procedure
- Onboarding instructions for CLI and console users
How we do it
A clear, safe process you can follow along with.
1. Prepare Organizations and a home region
Identity Center is enabled in one region for your organization, and that choice matters because it is hard to change later. We confirm the management account, delegated administration and region before enabling.
2. Connect the identity source
We choose the built-in directory, Active Directory or an external IdP. For an external provider we configure SAML for sign-in and SCIM for automatic user and group provisioning.
3. Design groups and permission sets
Access is assigned to groups, not individuals. We define permission sets such as read-only, developer, billing and administrator, using AWS managed or custom policies, with session duration and optional permissions boundaries.
4. Assign groups to accounts
We assign each group and permission set to the accounts it needs. Behind the scenes Identity Center creates a role in each account with a reserved name prefix, which we leave alone.
5. Configure the CLI and MFA
Developers run aws configure sso and aws sso login to get short-lived credentials. We enforce MFA in Identity Center or through the IdP and set sensible session lengths.
6. Migrate and retire IAM users
We inventory IAM users and keys with the credential report, move people over, update pipelines to roles, then disable and delete the old users and keys. Break-glass access stays documented and tested.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Assigning permission sets to individuals
Group assignment keeps offboarding to one change in the IdP.
Giving everyone administrator
Permission sets make least privilege easy. Use them.
No break-glass path
Keep a protected emergency IAM or root procedure in case the IdP is down.
Deleting IAM users before testing
Verify each person and pipeline works through SSO first.
Frequently Asked Questions
What is AWS IAM Identity Center?
It is the AWS service, formerly AWS SSO, that provides workforce single sign-on to AWS accounts and applications, with centrally managed permission sets and temporary credentials.
Does IAM Identity Center cost extra?
Identity Center itself is offered at no additional charge. You pay for the AWS resources your users create. Check current pricing for related directory services.
How do developers use SSO with the AWS CLI?
They configure an SSO profile with aws configure sso and sign in with aws sso login, which gives temporary credentials that refresh through the browser.
Want Help With AWS IAM Identity Center (SSO) setup?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required