View a markdown version of this page

Plan access to your Amazon account - Amazon Identity and Access Management
Identity sourcesAccess management
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Plan access to your Amazon account

When setting up Amazon, plan how you intend people to access your Amazon account and resources. A well-designed identity management solution keeps your account secure.

Identity sources

According to IAM best practices, we recommend that human users and workloads use temporary credentials to access your Amazon resources. You grant temporary credentials through IAM roles. Both users federated into IAM and user in IAM Identity Center (either federated or created in the IAM Identity Center directory) use IAM roles to access resources.

Before you start using Amazon, plan how to set up your identities by using one of the following approaches:

  • Enabling IAM Identity Center with Amazon Organizations and adding users in IAM Identity Center directly to the organizational directory.

    For instructions on adding users directly to the IAM Identity Center organizational directory, see Add users

  • Federating your existing external identity provider with either IAM Identity Center or IAM.

    For instructions on federating an external identity provider to the IAM Identity Center organizational directory, see the appropriate Getting started tutorial.

Access management

Identify the Amazon resources and services that your users need. Then define the access permissions and policies for each user, group, or role.

  • If you use IAM Identity Center, an IAM identity provider, IAM roles, and permissions policies are created in each Amazon account in your organization. These roles and permissions match what you specify when you assign people or groups to applications or Amazon accounts.

    For more information, see Assign user access and Set up single sign-on access to your applications.

  • You can use account access manager — an IAM feature that lets you assign existing IAM roles you create and manage to IAM Identity Center users and groups. Account access manager gives you access to the full IAM role feature set. You can use it alongside permission sets or on its own.

  • If you federate your identity provider directly with IAM in your Amazon Web Services account, you must create a role for your users to assume. The role needs a trust policy and a permissions policy. The trust policy states who can assume the role. The permissions policy states which Amazon actions and resources the role is allowed or denied access to.

    For more information, see Identity providers and federation into Amazon

For instructions on adding an extra layer of security for sign-in, see Use multi-factor authentication with your identities.