IAM Identity Center

One place for people to sign in and get access to many AWS accounts.

Think of it as: The front desk that hands you a temporary key card for whichever flat you're cleared for.

What to know for Level 0

Each person exists once in Identity Center and has one sign-in. The access portal lists the accounts they're assigned to and the permission sets they can use in each.
Opening an account from the portal assumes a role, so the person gets temporary credentials that expire on their own. No long-lived keys exist to leak.
Identity Center can use a company directory (Okta, Microsoft Entra ID, Active Directory) as its identity source, so people use their usual login.
To remove someone's access to every account, disable them once: in Identity Center, or in the directory it's connected to.
Identity Center and IAM are for the people and software that manage or call AWS. An app's own customers never become IAM or Identity Center users; Amazon Cognito handles them (Level 2).
Identity Center used to be called AWS SSO, so the roles it creates are named AWSReservedSSO_…. Change them through the permission set, never by hand.

More detail

You create users (or connect a company directory), then assign them permission sets in specific accounts. Signing in through the access portal gives temporary role credentials, never long-lived keys. It was formerly called AWS SSO, which is why its roles are named AWSReservedSSO_….

Quiz yourself on IAM Identity Center →

← All terms