Account access manager
What is account access manager?
Account access manager lets you assign Amazon Web Services account access to users and groups in your IAM Identity Center organization instance. You assign access using the IAM roles in your Amazon Web Services accounts. You can use account access manager alongside IAM Identity Center permission sets or on its own. Both account access manager and IAM Identity Center permission sets use the users and groups that you synchronized from your identity source or created directly in IAM Identity Center.
Why use account access manager?
Account access manager enables you to assign your existing IAM roles to the users and groups you have synchronized into IAM Identity Center from your corporate source of identities. Using your existing IAM roles gives you extra flexibility to tailor user access, including:
-
Configure IAM role tags and use session tags for attribute-based access control (ABAC).
-
Configure IAM role trust policy to restrict role assumption, enforce network-based conditions, or use IdP-asserted claims as trust policy conditions.
-
Configure IAM role paths to group roles logically and simplify administration. For more information, see Configure IAM role paths to group roles logically and simplify administration
.
The following table compares the three account access options:
| IAM roles + account access manager | IAM Identity Center permission sets | IAM roles + IAM federation (direct role assumption) | |
|---|---|---|---|
| Best for | Custom IAM roles that vary across accounts | Uniform baseline human access such as read-only and admin provisioned as immutable IAM roles | Suitable for workloads |
| Scope | Multiple accounts (Amazon organization) | Multiple accounts (Amazon organization) | Per account |
| IAM role provisioning | Requires infrastructure as code (IaC) or manual provisioning through the Amazon IAM console | Automatically provisioned | Requires infrastructure as code (IaC) or manual provisioning through Amazon IAM and external IdP consoles |
| Role-to-identity mapping resides in | Account access manager | IAM Identity Center | External IdP |
| End user experience | Users access Amazon accounts through the Amazon account access portal URL after signing into Amazon as IAM Identity Center users. | Users access Amazon accounts through the Amazon access portal after signing into Amazon as IAM Identity Center users. | Users access Amazon accounts through account-specific SAML applications (icons) in their IdP portal. |
| Amazon CLI user experience |
|
User configures a profile including the desired account and role pair by typing aws configure sso. User types aws sso login to initiate a new session using a profile. If there is no active IAM Identity Center session, the user authenticates in a browser and authorizes access there. See the Amazon IAM Identity Center User Guide for more details. | Custom integrations using Amazon SDK credential providers |
Key capabilities
- Account access portal
-
Account access manager provides users with an account access portal where they can view and access the Amazon Web Services accounts assigned to them through account access manager.
- CLI access
-
Your workforce can access Amazon Web Services accounts through the Amazon CLI using the aws login command after signing into Amazon in a browser.
- Account access APIs
-
Account access manager has its own API namespace,
account-access, which is separate from the IAM API. You use this namespace in the Amazon CLI and SDKs.