mrvitej.in

Archive · AWS

AWS SSO Is Now IAM Identity Center

Single sign-on across accounts, with short-lived credentials instead of IAM users and keys.

1 min read

  • IAM Identity Center
  • AWS Organizations
  • AWS CLI 2.7

On 26 July 2022 AWS Single Sign-On was renamed AWS IAM Identity Center. The service is the same, and it is the recommended way for people to reach many accounts.

How it works: you create users and groups, define permission sets (such as ReadOnly or Admin), and assign each group a permission set per account. People sign in at one portal and receive temporary credentials.

Use it from the command line with AWS CLI v2:

aws configure sso
# SSO start URL, region, account, role -> creates a named profile
aws sso login --profile prod-readonly
aws sts get-caller-identity --profile prod-readonly

Why it beats long-lived IAM users:

  • No access keys in ~/.aws/credentials that can leak.
  • Offboarding is one change at the directory, not one per account.
  • Credentials expire automatically (hours, not months).

Keep the management account for administration only, and require MFA in the identity source. Break-glass access for emergencies should be a documented, monitored IAM role.