AWS IAM Identity Center
- What it is
- Centralized workforce single sign-on across all accounts in AWS Organizations and to business SaaS applications.
- Formerly AWS Single Sign-On (AWS SSO).
- How it works
- One identity source: the built-in directory, Microsoft Active Directory via AWS Directory Service, or an external IdP (Okta, Entra ID) over SAML/SCIM.
- Permission sets define what a user can do; assign them to users/groups per account.
- Users get one portal and one login for every account. Credentials are temporary — no long-lived access keys.
- Why it beats per-account IAM users
- No duplicate users per account, no key rotation burden, one place to deprovision a departing employee.
- Not to be confused with
- Amazon Cognito — end-customer identity for your applications.
- IAM roles — the mechanism underneath; Identity Center is the management layer over it.