# Account access manager
<a name="account-access-manager"></a>

## What is account access manager?
<a name="what-is-account-access-manager"></a>

Account access manager lets you assign Amazon Web Services account access to users and groups in your IAM Identity Center organization instance. You assign access using the [IAM roles](id_roles.md) in your Amazon Web Services accounts. You can use account access manager alongside [IAM Identity Center permission sets](https://docs.amazonaws.cn/singlesignon/latest/userguide/permissionsetsconcept.html) or on its own. Both account access manager and IAM Identity Center permission sets use the users and groups that you synchronized from your identity source or created directly in [IAM Identity Center](https://docs.amazonaws.cn/singlesignon/latest/userguide/what-is.html).

## Why use account access manager?
<a name="why-use-account-access-manager"></a>

Account access manager enables you to assign your existing IAM roles to the users and groups you have synchronized into IAM Identity Center from your corporate source of identities. Using your existing IAM roles gives you extra flexibility to tailor user access, including:
+ Configure IAM role tags and use session tags for attribute-based access control (ABAC).
+ Configure IAM role trust policy to restrict role assumption, enforce network-based conditions, or use IdP-asserted claims as trust policy conditions.
+ Configure IAM role paths to group roles logically and simplify administration. For more information, see [Configure IAM role paths to group roles logically and simplify administration](https://aws.amazon.com/blogs/security/optimize-aws-administration-with-iam-paths/).

The following table compares the three account access options:


|   | IAM roles \+ account access manager | IAM Identity Center permission sets | IAM roles \+ IAM federation (direct role assumption) | 
| --- | --- | --- | --- | 
| Best for | Custom IAM roles that vary across accounts | Uniform baseline human access such as read-only and admin provisioned as immutable IAM roles | Suitable for workloads | 
| Scope | Multiple accounts (Amazon organization) | Multiple accounts (Amazon organization) | Per account | 
| IAM role provisioning | Requires infrastructure as code (IaC) or manual provisioning through the Amazon IAM console | Automatically provisioned | Requires infrastructure as code (IaC) or manual provisioning through Amazon IAM and external IdP consoles | 
| Role-to-identity mapping resides in | Account access manager | IAM Identity Center | External IdP | 
| End user experience | Users access Amazon accounts through the Amazon account access portal URL after signing into Amazon as IAM Identity Center users. | Users access Amazon accounts through the Amazon access portal after signing into Amazon as IAM Identity Center users. | Users access Amazon accounts through account-specific SAML applications (icons) in their IdP portal. | 
| Amazon CLI user experience | 1.  User signs into Amazon and then accesses an account with a specific role in a web browser. <br />2.  User types **aws login** on the command line to retrieve the IAM role session credentials from the browser. For the duration of the IAM role session, the user can keep working with the Amazon CLI without having to re-authenticate in step 1.  | User configures a profile including the desired account and role pair by typing aws configure sso. User types aws sso login to initiate a new session using a profile. If there is no active IAM Identity Center session, the user authenticates in a browser and authorizes access there. See the [Amazon IAM Identity Center User Guide](https://docs.amazonaws.cn/cli/latest/userguide/cli-configure-sso.html) for more details. | Custom integrations using Amazon SDK credential providers | 

## Key capabilities
<a name="aam-key-capabilities"></a>

**Account access portal**  
Account access manager provides users with an account access portal where they can view and access the Amazon Web Services accounts assigned to them through account access manager.

**CLI access**  
Your workforce can access Amazon Web Services accounts through the Amazon CLI using the [**aws login** command](https://docs.amazonaws.cn/signin/latest/userguide/command-line-sign-in.html#command-line-sign-in-local-development) after signing into Amazon in a browser.

**Account access APIs**  
Account access manager has its own API namespace, `account-access`, which is separate from the IAM API. You use this namespace in the Amazon CLI and SDKs.