IAM Identity Center
Identity & AccessIAM Identity Center (formerly AWS SSO) is the recommended way to manage human access to AWS accounts and business applications. It provides a single sign-on experience across all your AWS accounts in an organization.
Key Features
- Centralized Access: one place to manage access to all AWS accounts
- Permission Sets: reusable sets of IAM policies assigned to users/groups for specific accounts
- Identity Sources: built-in directory, Active Directory (AD Connector or AWS Managed AD), or external IdP (Okta, Azure AD, Ping)
- MFA: built-in MFA with WebAuthn/FIDO2, authenticator apps, and RADIUS
- Application Assignments: SSO access to SAML 2.0 applications (Salesforce, Slack, etc.)
Why Use It
- Eliminates IAM users - no more long-term credentials for humans
- Centralized audit trail of who accessed which account
- Automatic credential rotation (temporary credentials via STS)
- Works with AWS Organizations for multi-account management
Related AWS Services
Related Content
Related Terms
A centralized authentication mechanism that allows users to log in once and access multiple AWS accounts and applications without re-entering credentials.
The process of allowing external identities (corporate directory, social providers) to access AWS resources without creating IAM users, using SAML, OIDC, or IAM Identity Center.
A security mechanism requiring two or more forms of verification (password + device/token) before granting access to an AWS account or resource.
Using multiple AWS accounts to isolate workloads, environments, and teams, providing the strongest security boundary available in AWS.
Short-lived AWS credentials (access key, secret key, session token) issued by STS that expire automatically, eliminating the risk of permanent credential exposure.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.