AWS IAM Identity Center (Single Sign-On)

AWS IAM Identity Center, formerly AWS Single Sign-On, is the Amazon Web Services service for giving a workforce one sign-in across many AWS accounts and business applications. One identity, one set of permission sets, applied consistently across an organisation’s accounts.

Key points

• Built for multi-account access: it integrates with AWS Organizations so permission sets can be assigned to users and groups across every member account from one place, replacing per-account AWS Identity and Access Management (IAM) users.
• Permission sets are the core mechanic: a permission set is a template/container of one or more IAM policies (AWS managed, customer managed, or inline). When an administrator assigns a permission set to a user or group for a target AWS account, IAM Identity Center provisions it as an IAM role inside that account and attaches the specified policies to that role. The same permission set can be assigned to many accounts at once, so one template fans out into many per-account IAM roles that IAM Identity Center continues to manage — editing the permission set updates every provisioned role.
• Has its own identity store, or connects to an external identity provider — Microsoft Active Directory via AWS Directory Service, or any SAML 2.0 provider such as Okta or Entra ID.
• Users get a single access portal listing the accounts and roles they may assume, and sign-in yields temporary credentials rather than long-lived access keys.
• Application assignments — beyond AWS accounts, administrators can assign third-party business applications that support SAML 2.0 or OIDC (for example Salesforce or Slack) to the same users and groups, so a single sign-in gives workforce users access to both their AWS accounts and their SaaS applications from one access portal.
• The distinction that matters: Identity Center is for an organisation’s employees accessing AWS. Amazon Cognito is for an application’s end users signing up and signing in, including through social identity providers — a customer-facing shopping site uses Cognito, not Identity Center.
• Distinct from AWS Security Token Service (STS), which is the underlying mechanism issuing temporary, limited-privilege credentials rather than a workforce sign-in experience.
• AWS Single Sign-On was renamed AWS IAM Identity Center on July 26, 2022; the sso, identitystore, and sso-admin API/CLI namespaces, service-linked role name, and console URLs still contain sso for backward compatibility, but “AWS SSO” is not the current product name.
• Supports two instance types: an organization instance (deployed in the Organizations management account, the only kind that can manage access to AWS accounts) and an account instance (bound to a single account, used for isolated deployments of specific AWS managed applications).

Pricing

• AWS IAM Identity Center itself has no additional charge; you pay only for the underlying AWS resources and accounts your workforce accesses through it.

Sources

• What is IAM Identity Center?
• Manage AWS accounts with permission sets