Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon IAM Identity Center Region availability

You can enable IAM Identity Center in most Amazon Web Services Regions and it's available to users globally. This global availability makes it easier for you to configure user access to multiple Amazon Web Services accounts and applications. When your users sign in to the Amazon Web Services access portal, they can select the Amazon Web Services account to which they have permissions, and then access the Amazon Web Services Management Console. For a full list of the Amazon Web Services Regions that IAM Identity Center supports, see IAM Identity Center endpoints and quotas.

IAM Identity Center Region data

When you enable IAM Identity Center, all the data that you configure in IAM Identity Center is stored in the Region where you configured it. This data includes directory configurations, permission sets, application instances, and user assignments to Amazon Web Services account applications. If you are using the IAM Identity Center identity store, all users and groups that you create in IAM Identity Center are also stored in the same Region.

Choosing your Region

We recommend that you install IAM Identity Center in a Region that you intend to keep available for users, not a Region that you might need to disable. See Considerations for choosing an Amazon Web Services Region.

If you enable an organization instance of IAM Identity Center in the management account of your Amazon organization in one Region and later decide to switch to a different Region, you must first delete your current IAM Identity Center instance. Switching to a different Region also changes the URL for the Amazon Web Services access portal, and you must reconfigure all permission sets and assignments.

Cross-Region calls

When attempting to sign-in with one-time password (OTP) as a second authentication factor and for certain identity and credential management events, such as when the user is invited to set up an initial password, verify an email address, and reset their password, IAM Identity Center in China (Beijing) Region makes cross-Region API calls to China (Ningxia) Region to send emails. In these cross-Region calls, user attributes include:

Managing IAM Identity Center in an opt-in Region (Region that is disabled by default)

Most Amazon Web Services Regions are enabled for operations in all Amazon services by default. Those Regions are automatically activated for use with IAM Identity Center. The following Amazon Web Services Regions are opt-in Regions and you must enable them if you want to use IAM Identity Center:

When you enable IAM Identity Center for a management account in an opt-in Amazon Web Services Region, the following IAM Identity Center metadata for any member accounts is stored in the Region.

Disabling an Amazon Web Services Region where IAM Identity Center is enabled

If you disable an Amazon Web Services Region in which IAM Identity Center is installed, IAM Identity Center is also disabled. After IAM Identity Center is disabled in a Region, users in that Region won’t have single sign-on access to Amazon Web Services accounts and applications. Amazon retains the data in your IAM Identity Center configuration for at least 10 days. If you re-enable the Amazon Web Services Region within this time frame, your IAM Identity Center configuration data will still be available in the Region.

To re-enable IAM Identity Center in opt-in Amazon Web Services Regions, you must re-enable the Region. Because IAM Identity Center must reprocess all paused events again, re-enabling IAM Identity Center might take some time.

For more information about enabling and disabling Amazon Web Services Regions, see Managing Amazon Web Services Regions in the Amazon General Reference.