AWS IAM Identity Center
Centralized workforce sign-on: one login, one identity source, access to all AWS accounts and apps in your organization.
Verified against AWS documentation · 2026-08-28
Key facts
- 01Formerly AWS SSO (renamed 2022) — CLI commands, API namespaces, and console URLs still say `sso`
- 02Deployed in the AWS Organizations management account; permission sets are provisioned into member accounts as IAM roles
- 03Identity source options: built-in directory, Active Directory, or external IdP (Entra ID, Okta) via SAML 2.0 + SCIM sync — one identity source per organization
- 04Users sign in once at the AWS access portal and see every account and app assigned to them
Exam triggers
Phrases and scenarios that point here.
- "Single sign-on across multiple AWS accounts" → Identity Center, not IAM users per account
- "Centrally manage workforce access" with AWS Organizations in the question → Identity Center
- "Connect existing corporate directory / Active Directory for AWS access" → Identity Center with AD or external IdP
- "Temporary credentials, no long-lived access keys for employees" → Identity Center permission sets
Not this service
- Customer-facing app logins (sign-up/sign-in for your users) → Amazon Cognito
- Fine-grained policies, roles, and service permissions inside one account → IAM
- Running an actual Microsoft AD in the cloud → AWS Directory Service
Use cases
- 01New hire joins the platform team: add them to one group in your IdP, and SCIM sync plus group assignments give them dev access in three accounts by lunch — no per-account IAM user creation
- 02Replacing the spreadsheet of shared IAM access keys: everyone signs in through the access portal and gets short-lived credentials, so offboarding is deleting one user, not hunting keys across 12 accounts
- 03Standardizing job-function access: define an 'auditor' permission set once, provision it to every account, and every auditor gets identical read-only access everywhere
- 04CLI and IDE access without stored keys: `aws configure sso` gives engineers temporary credentials tied to their real identity, so CloudTrail shows who did what
- 05One federation point for AWS managed apps (Amazon Q Developer, Redshift, QuickSight) instead of wiring your IdP to each app separately
How it's charged
- 01No charge — Identity Center itself is free, including users, permission sets, and the access portal
- 02Cost shows up in what you attach: AWS Managed Microsoft AD (if that's your identity source) and your external IdP subscription are billed separately
- 03Exam angle: 'reduce cost of managing multi-account access' answers favor Identity Center partly because it adds zero service cost
