AWS IAM Identity Center: Workforce SSO

AWS IAM Identity Center (formerly AWS SSO) provides centralized workforce identity management across your AWS Organization. Instead of creating IAM users in every account, you create users once in Identity Center and grant access to multiple accounts via permission sets. This lab teaches you to implement enterprise-grade SSO with MFA enforcement, external IdP integration, and CLI access via identity-aware sessions.

Lab Modules

Lab Overview & Identity Center Architecture
Module 1: Enable IAM Identity Center
Module 2: Users, Groups & Directory
Module 3: Permission Sets
Module 4: Account Assignments
Module 5: External IdP Integration (SAML/SCIM)
Module 6: AWS CLI & SDK Access
Module 7: Application Assignments
Security Best Practices

Lab Overview

IAM Identity Center eliminates the chaos of managing IAM users across dozens or hundreds of AWS accounts. With a single identity, users can access all their assigned accounts through a central portal, and administrators manage access centrally with permission sets that define what users can do in each account.

Key Concepts

Identity Source: Where users are stored (Identity Center directory, AD, external IdP)
Permission Sets: Collections of IAM policies that define access level
Account Assignment: Linking users/groups to accounts with permission sets
User Portal: Web interface where users see and access their accounts
Session Duration: How long credentials are valid (1-12 hours)

Common Permission Sets

AdministratorAccess

Full admin rights. Reserved for platform/cloud teams.

PowerUserAccess

Full access except IAM. For developers in dev accounts.

ReadOnlyAccess

View-only access. For auditors, finance, observers.

ViewOnlyAccess

More restrictive read-only. No sensitive data access.

DatabaseAdministrator

RDS, DynamoDB, Redshift management.

Custom-DeveloperAccess

Tailored for your organization's developer needs.

Module 1: Enable IAM Identity Center

Module 1: Set Up IAM Identity Center

Enable and configure the central identity service.

30-45 minutes4 steps

1

Enable IAM Identity Center

Identity Center

Navigate to: IAM Identity Center
(Search "IAM Identity Center" or "SSO")

If using AWS Organizations:
 Click "Enable"

Identity Center is enabled in ONE region only.
Choose your primary region (e.g., us-east-1).

After enabling:
- User portal URL created automatically
- Identity source defaults to Identity Center directory

Note your User Portal URL:
https://d-xxxxxxxxxx.awsapps.com/start
(Customize this later)

2

Configure Identity Source

Identity Center

Navigate to: Settings Identity source

Options:
1. Identity Center directory (default)
 - Built-in directory, good for small teams
 - Manual user/group management

2. Active Directory
 - AWS Managed AD or AD Connector
 - Sync users from on-prem AD

3. External identity provider
 - Okta, Azure AD, Google Workspace, etc.
 - SAML 2.0 + SCIM for provisioning

For this lab, use Identity Center directory.
(Module 5 covers external IdP integration)

3

Configure MFA

Identity Center

Navigate to: Settings Authentication

MFA Settings:
- MFA prompt: Every time they sign in
 OR: Only when sign-in context changes (risk-based)

- Users can use these MFA types:
 ✓ Authenticator apps
 ✓ Security keys (FIDO2)
 ✓ Built-in authenticators (Touch ID, Windows Hello)

- If user doesn't have MFA registered:
 Require them to register at sign in

- Who can manage MFA devices:
 Users can add/remove their own

 Click "Save changes"

4

Customize Access Portal

Identity Center

Navigate to: Settings Access portal

Customize URL:
 Click "Customize"
 Enter: yourcompany
 New URL: https://yourcompany.awsapps.com/start

Portal branding (optional):
- Upload company logo
- Customize display name

Session settings:
 Click "Session settings"
- Session duration: 8 hours (default 1 hour)
 (How long portal session lasts)

 Save all settings

Module 2: Users, Groups & Directory

Module 2: Create Users and Groups

Build your identity directory with users and groups.

30-45 minutes4 steps

5

Create Groups

Identity Center

Navigate to: Groups Create group

Create job-function groups:

Group 1:
- Group name: Platform-Admins
- Description: Full admin access to all accounts
 Create group

Group 2:
- Group name: Developers
- Description: Developer access to dev/staging
 Create group

Group 3:
- Group name: Operations
- Description: Read + monitoring access
 Create group

Group 4:
- Group name: Security-Auditors
- Description: Read-only security audit access
 Create group

Best practice: Assign permissions to groups, not users!

6

Create Users

Identity Center

Navigate to: Users Add user

User 1 (Platform Admin):
- Username: alice
- Email: alice@yourcompany.com
- First name: Alice
- Last name: Admin
- Display name: Alice Admin
- Generate one-time password: Yes
 Add user

User 2 (Developer):
- Username: bob
- Email: bob@yourcompany.com
- First name: Bob
- Last name: Developer
 Add user

User 3 (Operations):
- Username: carol
- Email: carol@yourcompany.com
- First name: Carol
- Last name: Ops
 Add user

Users receive email with portal URL and temporary password.

7

Add Users to Groups

Identity Center

Navigate to: Groups Platform-Admins
 Add users
 Select: alice
 Add users

Navigate to: Groups Developers
 Add users
 Select: bob
 Add users

Navigate to: Groups Operations
 Add users
 Select: carol
 Add users

Verify memberships:
Navigate to: Users [user] Groups tab
Shows all groups user belongs to.

8

Manage Users via CLI

AWS CLI

# Get Identity Store ID
INSTANCE_ARN=$(aws sso-admin list-instances \
    --query 'Instances[0].InstanceArn' --output text)
IDENTITY_STORE_ID=$(aws sso-admin list-instances \
    --query 'Instances[0].IdentityStoreId' --output text)

# List users
aws identitystore list-users \
    --identity-store-id $IDENTITY_STORE_ID

# List groups
aws identitystore list-groups \
    --identity-store-id $IDENTITY_STORE_ID

# Create user via CLI
aws identitystore create-user \
    --identity-store-id $IDENTITY_STORE_ID \
    --user-name "dave" \
    --display-name "Dave DevOps" \
    --name '{"FamilyName":"DevOps","GivenName":"Dave"}' \
    --emails '[{"Value":"dave@company.com","Primary":true}]'

Module 3: Permission Sets

Module 3: Create and Configure Permission Sets

Define access levels with permission sets.

45-60 minutes5 steps

9

Create AWS Managed Permission Set

Identity Center

Navigate to: Permission sets Create permission set

Permission set type:
 Select "Predefined permission set"
 Select: AdministratorAccess
 Next

Specify details:
- Permission set name: AdministratorAccess
- Description: Full admin access
- Session duration: 4 hours
- Relay state: (leave blank)
 Next

Review and create

Repeat for:
- ReadOnlyAccess
- PowerUserAccess
- ViewOnlyAccess

10

Create Custom Permission Set

Identity Center

Navigate to: Permission sets Create permission set

Permission set type:
 Select "Custom permission set"
 Next

Specify policies:
 Select "Inline policy"

Paste this policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DeveloperEC2",
            "Effect": "Allow",
            "Action": [
                "ec2:*"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/Environment": "Development"
                }
            }
        },
        {
            "Sid": "DeveloperS3",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::dev-*",
                "arn:aws:s3:::dev-*/*"
            ]
        },
        {
            "Sid": "DeveloperLambda",
            "Effect": "Allow",
            "Action": [
                "lambda:*"
            ],
            "Resource": "arn:aws:lambda:*:*:function:dev-*"
        },
        {
            "Sid": "ReadCloudWatch",
            "Effect": "Allow",
            "Action": [
                "cloudwatch:Get*",
                "cloudwatch:List*",
                "logs:Get*",
                "logs:Describe*"
            ],
            "Resource": "*"
        }
    ]
}

Permission set details:
- Name: DeveloperAccess-Custom
- Description: Restricted developer access for dev resources
- Session duration: 8 hours

 Create permission set

11

Add Permission Boundary

Identity Center

Navigate to: Permission sets DeveloperAccess-Custom
 Edit

Scroll to: Permission boundary

Add AWS managed policy as boundary:
 Select: PowerUserAccess

This ensures even if inline policy is overly permissive,
the permission boundary limits effective permissions.

 Save changes

12

Create Permission Set via CLI

AWS CLI

# Get SSO instance ARN
INSTANCE_ARN=$(aws sso-admin list-instances \
    --query 'Instances[0].InstanceArn' --output text)

# Create permission set
aws sso-admin create-permission-set \
    --instance-arn $INSTANCE_ARN \
    --name "SecurityAuditor" \
    --description "Security audit read-only access" \
    --session-duration "PT4H"

# Get permission set ARN
PS_ARN=$(aws sso-admin list-permission-sets \
    --instance-arn $INSTANCE_ARN \
    --query "PermissionSets[?ends_with(@, 'SecurityAuditor')]" \
    --output text)

# Attach managed policy
aws sso-admin attach-managed-policy-to-permission-set \
    --instance-arn $INSTANCE_ARN \
    --permission-set-arn $PS_ARN \
    --managed-policy-arn "arn:aws:iam::aws:policy/SecurityAudit"

13

View Permission Sets

Identity Center

Navigate to: Permission sets

You should have:
- AdministratorAccess (AWS managed)
- PowerUserAccess (AWS managed)
- ReadOnlyAccess (AWS managed)
- DeveloperAccess-Custom (Custom)
- SecurityAuditor (Custom)

Each shows:
- Type (AWS managed vs Custom)
- Session duration
- Number of accounts assigned

Module 4: Account Assignments

Module 4: Assign Users/Groups to Accounts

Connect identities to AWS accounts with permission sets.

30-45 minutes4 steps

14

Assign Group to Account

Identity Center

Navigate to: AWS accounts

Select account(s):
 Check: Management Account
 Click "Assign users or groups"

Select users/groups:
 Click "Groups" tab
 Select: Platform-Admins
 Next

Select permission sets:
 Select: AdministratorAccess
 Next

Review and submit:
 Submit

Platform-Admins group now has AdministratorAccess
to the Management Account!

15

Create Multiple Assignments

Identity Center

Create assignments for your organization:

Developers group:
- Workload-Dev account DeveloperAccess-Custom
- Workload-Dev account ReadOnlyAccess (for viewing)
- Workload-Staging account ReadOnlyAccess

Operations group:
- All workload accounts ReadOnlyAccess
- All workload accounts CloudWatchFullAccess (if created)

Security-Auditors group:
- All accounts SecurityAuditor
- Log-Archive account ReadOnlyAccess

Platform-Admins group:
- All accounts AdministratorAccess

Repeat the assignment process for each combination.

16

Assign via CLI

AWS CLI

# Variables
INSTANCE_ARN=$(aws sso-admin list-instances \
    --query 'Instances[0].InstanceArn' --output text)
IDENTITY_STORE_ID=$(aws sso-admin list-instances \
    --query 'Instances[0].IdentityStoreId' --output text)

# Get group ID
GROUP_ID=$(aws identitystore list-groups \
    --identity-store-id $IDENTITY_STORE_ID \
    --query "Groups[?DisplayName=='Developers'].GroupId" \
    --output text)

# Get permission set ARN
PS_ARN=$(aws sso-admin list-permission-sets \
    --instance-arn $INSTANCE_ARN \
    --query "PermissionSets[0]" --output text)

# Create account assignment
TARGET_ACCOUNT_ID="123456789012"

aws sso-admin create-account-assignment \
    --instance-arn $INSTANCE_ARN \
    --target-id $TARGET_ACCOUNT_ID \
    --target-type AWS_ACCOUNT \
    --permission-set-arn $PS_ARN \
    --principal-type GROUP \
    --principal-id $GROUP_ID

17

Test User Portal Access

User Portal

Sign in as a user:
Navigate to: https://yourcompany.awsapps.com/start

Enter username: bob
Enter password: [from email]
Complete MFA setup (first login)

User portal shows:
- All AWS accounts bob has access to
- Permission sets available per account

Click on account:
 Shows available permission sets
 Click "Management console" to federate in
 Or click "Command line or programmatic access"
 for temporary credentials

User is now signed into AWS Console
with the selected permission set!

Module 5: External IdP Integration

Module 5: Connect Azure AD, Okta, or Google Workspace

Federate with external identity providers via SAML and SCIM.

60-90 minutes5 steps

18

Change Identity Source

Identity Center

Navigate to: Settings Identity source
 Actions Change identity source

 WARNING: Changing identity source deletes all users,
groups, and assignments. Export/document first!

Select: External identity provider
 Next

Download metadata:
- AWS SSO SAML metadata file
- Or copy individual values:
 - AWS SSO Sign-in URL
 - AWS SSO ACS URL
 - AWS SSO Issuer URL

You'll configure these in your IdP.

19

Configure Azure AD (Example)

AWS Console

In Azure AD (Entra ID):

1. Add Enterprise Application:
 Azure AD Enterprise applications New
 Search "AWS IAM Identity Center"
 Add

2. Configure SAML:
 Single sign-on SAML
 Edit Basic SAML Configuration:
 - Identifier: [AWS SSO Issuer URL]
 - Reply URL: [AWS SSO ACS URL]
 - Sign on URL: [AWS SSO Sign-in URL]

3. Download Azure AD metadata:
 Federation Metadata XML Download

4. Configure Provisioning (SCIM):
 Provisioning Get started
 Mode: Automatic
 - Tenant URL: [SCIM endpoint from AWS]
 - Secret Token: [SCIM token from AWS]
 Test connection Save
 Enable provisioning

20

Upload IdP Metadata to AWS

Identity Center

Back in AWS IAM Identity Center:

Identity provider metadata:
 Upload: [IdP metadata XML file]
 Or enter manually:
 - IdP sign-in URL
 - IdP issuer URL
 - IdP certificate

 Next

Enable automatic provisioning (SCIM):
 Enable
 Note the SCIM endpoint URL
 Generate access token (copy immediately!)

 Complete setup

Users/groups now sync from external IdP!

21

Configure Attribute Mappings

Identity Center

Navigate to: Settings Attributes for access control

Map IdP attributes to AWS session tags:
 Add attribute

Example mappings:
- Key: Department
 Value: ${path:enterprise.department}

- Key: CostCenter 
 Value: ${path:enterprise.costCenter}

- Key: Team
 Value: ${path:custom.team}

These become session tags in AWS, usable in policies:
"Condition": {
 "StringEquals": {
 "aws:PrincipalTag/Department": "Engineering"
 }
}

22

Test IdP Login

User Portal

Test the integration:

Option 1: IdP-initiated login
- Go to IdP app portal (Azure MyApps, Okta dashboard)
- Click AWS IAM Identity Center app
- Redirected to AWS SSO portal

Option 2: SP-initiated login
- Go to: https://yourcompany.awsapps.com/start
- Click "Sign in with your corporate ID"
- Redirected to IdP for authentication
- After auth, returned to AWS portal

Verify:
- User sees their assigned accounts
- Groups synced correctly from IdP
- Assignments work as expected

Module 6: AWS CLI & SDK Access

Module 6: Configure CLI Access with Identity Center

Use short-lived credentials from Identity Center for CLI access.

30-45 minutes4 steps

23

Configure AWS CLI v2 with SSO

AWS CLI

# Configure SSO profile
aws configure sso

# Prompts:
# SSO session name: my-sso
# SSO start URL: https://yourcompany.awsapps.com/start
# SSO region: us-east-1
# SSO registration scopes: sso:account:access

# Browser opens for authentication
# After auth, select account and permission set

# CLI profile name: dev-account

# This creates ~/.aws/config entry:
[profile dev-account]
sso_session = my-sso
sso_account_id = 123456789012
sso_role_name = DeveloperAccess-Custom
region = us-east-1

[sso-session my-sso]
sso_start_url = https://yourcompany.awsapps.com/start
sso_region = us-east-1
sso_registration_scopes = sso:account:access

24

Login and Use Profile

AWS CLI

# Login to SSO (opens browser)
aws sso login --profile dev-account

# Or login to session (access all profiles)
aws sso login --sso-session my-sso

# Use the profile
aws s3 ls --profile dev-account
aws ec2 describe-instances --profile dev-account

# Set as default profile
export AWS_PROFILE=dev-account

# Now commands use SSO credentials automatically
aws sts get-caller-identity

# Credentials are cached and auto-refresh
# When they expire, you'll be prompted to re-authenticate

25

Get Temporary Credentials

User Portal

From user portal, get credentials for scripts:

1. Login to: https://yourcompany.awsapps.com/start
2. Click on account
3. Click "Command line or programmatic access"

Options shown:
- Option 1: Set environment variables
  export AWS_ACCESS_KEY_ID="ASIA..."
  export AWS_SECRET_ACCESS_KEY="..."
  export AWS_SESSION_TOKEN="..."

- Option 2: Add to credentials file
  [123456789012_DeveloperAccess]
  aws_access_key_id=ASIA...
  
- Option 3: Use with --profile

These are temporary credentials (match session duration).

26

Configure Multiple Profiles

AWS CLI

# Add multiple profiles to ~/.aws/config

[sso-session my-sso]
sso_start_url = https://yourcompany.awsapps.com/start
sso_region = us-east-1
sso_registration_scopes = sso:account:access

[profile dev-admin]
sso_session = my-sso
sso_account_id = 111111111111
sso_role_name = AdministratorAccess
region = us-east-1

[profile dev-developer]
sso_session = my-sso
sso_account_id = 111111111111
sso_role_name = DeveloperAccess-Custom
region = us-east-1

[profile prod-readonly]
sso_session = my-sso
sso_account_id = 222222222222
sso_role_name = ReadOnlyAccess
region = us-east-1

[profile prod-admin]
sso_session = my-sso
sso_account_id = 222222222222
sso_role_name = AdministratorAccess
region = us-east-1

# Single login provides access to all profiles!
aws sso login --sso-session my-sso

# Switch between profiles easily
aws s3 ls --profile dev-developer
aws s3 ls --profile prod-readonly

Module 7: Application Assignments

Module 7: SSO to Third-Party Applications

Extend SSO to SaaS applications beyond AWS.

30-45 minutes3 steps

27

Add Custom SAML Application

Identity Center

Navigate to: Applications Add application

Application type:
 Select "I have an application I want to set up"
 Select "Application type: SAML 2.0"
 Next

Application metadata:
- Display name: Internal HR Portal
- Description: Company HR system

SAML configuration:
- Application ACS URL: https://hr.company.com/saml/acs
- Application SAML audience: https://hr.company.com

 Submit

Download AWS SSO metadata for the HR app
to configure on the HR portal side.

28

Assign Users to Application

Identity Center

Navigate to: Applications Internal HR Portal
 Assign users and groups

Select groups:
 Check: All-Employees (or relevant group)
 Save

All users in the group now see this app
in their SSO portal alongside AWS accounts.

29

Add Pre-Integrated Application

Identity Center

Navigate to: Applications Add application
 Select "Add from application catalog"

Search catalog for pre-integrated apps:
- Salesforce
- Slack
- Zoom
- ServiceNow
- Jira
- Confluence
- GitHub
- Many more...

Select application:
 Follow guided setup
 AWS provides pre-configured settings
 Copy metadata to target application
 Assign users/groups

Users get SSO access to both AWS accounts
AND business applications from single portal!

Security Best Practices

IAM Identity Center Best Practices

Require MFA for all users at every sign-in
Use groups for assignments, not individual users
Create custom permission sets with least privilege
Set appropriate session durations (shorter for prod)
Use permission boundaries on permission sets
Integrate with external IdP for enterprise (Azure AD, Okta)
Enable SCIM for automatic user/group provisioning
Use attribute-based access control (ABAC) with session tags
Monitor CloudTrail for SSO events
Regular access reviews of assignments
Document all permission sets and their purposes

LAB 12: AWS IAM Identity Center (SSO)

Table of Contents

Lab Modules

Lab Overview

Key Concepts

Common Permission Sets

AdministratorAccess

PowerUserAccess

ReadOnlyAccess

ViewOnlyAccess

DatabaseAdministrator

Custom-DeveloperAccess

Module 1: Enable IAM Identity Center

Module 1: Set Up IAM Identity Center

Enable IAM Identity Center

Configure Identity Source

Configure MFA

Customize Access Portal

Module 2: Users, Groups & Directory

Module 2: Create Users and Groups

Create Groups

Create Users

Add Users to Groups

Manage Users via CLI

Module 3: Permission Sets

Module 3: Create and Configure Permission Sets

Create AWS Managed Permission Set

Create Custom Permission Set

Add Permission Boundary

Create Permission Set via CLI

View Permission Sets

Module 4: Account Assignments

Module 4: Assign Users/Groups to Accounts

Assign Group to Account

Create Multiple Assignments

Assign via CLI

Test User Portal Access

Module 5: External IdP Integration

Module 5: Connect Azure AD, Okta, or Google Workspace

Change Identity Source

Configure Azure AD (Example)

Upload IdP Metadata to AWS

Configure Attribute Mappings

Test IdP Login

Module 6: AWS CLI & SDK Access

Module 6: Configure CLI Access with Identity Center

Configure AWS CLI v2 with SSO

Login and Use Profile

Get Temporary Credentials

Configure Multiple Profiles

Module 7: Application Assignments

Module 7: SSO to Third-Party Applications

Add Custom SAML Application

Assign Users to Application

Add Pre-Integrated Application

Security Best Practices

IAM Identity Center Best Practices