IAM Identity Center
IAM Identity Center is the AWS single sign-on service: one place where people sign in, and from which they are granted temporary access to any account in the organization. In the platform it is the only way a human reaches AWS.
What it does
Identity Center holds users and groups, either created directly or synced from an external identity provider. A permission set is a template of IAM permissions with a session length. An account assignment joins a group, a permission set and an account: everyone in that group can open that account with those permissions. When a person signs in, Identity Center creates a short-lived role session in the chosen account; nothing permanent is stored on the laptop. MFA is enforced at sign-in.
How BuiltForProd uses it
The iam-identity-center unit (definition units/iam-identity-center, module modules/iam-identity-center) runs in core-identity, the delegated administrator named by AWS Organizations. It expects groups named ACME_<Role> to exist already, looks them up by display name, and assigns permission sets per account. The unit does not configure the identity provider or SCIM sync.
Eleven permission sets are defined, all with 12-hour sessions. Ten are in the unit:
| Permission set | Policy | Who |
|---|---|---|
PlatformAdminAccess, DevOpsAdminAccess | AdministratorAccess | Platform Leads (all accounts), DevOps Leads (all plat-* accounts) |
PlatformEngineerAccess, DevOpsEngineerAccess, AppDeveloperAccess, DataEngineerAccess, AIEngineerAccess | PowerUserAccess | Engineers in lower environments |
ReadOnlyAccess | ReadOnlyAccess | Engineers in plat-prod; DevOps groups in core-* |
SecurityAuditorAccess, LeadSecurityAuditorAccess | SecurityAudit plus an inline policy | Auditors in every account; the inline policy allows audit tools and denies reading S3 objects, parameter values, secrets, database data and log events |
The pattern is that write access narrows as environments get closer to production. Platform Engineers are power users in core-*, sandbox, dev and staging, and read-only in prod. App, data and AI developers get sandbox and dev; their leads add staging. Only Platform and DevOps leads can change prod.
Access to the management account is the eleventh, a separate ManagementAdminAccess permission set for Platform Leads, enabled with enable_sso_mgmt_access in the Organizations unit once the groups exist.
Two other places rely on the same groups. Client VPN authenticates users with a SAML application in Identity Center and maps group IDs to the stages each group may reach. The SOPS key policies in the secrets blueprint grant encrypt and decrypt rights per group and stage. On the command line, engineers use aws sso login with named profiles; Terragrunt then assumes the target account role from that session.
Terms you will see
| Term | Meaning |
|---|---|
| Permission set | A reusable bundle of IAM permissions plus a session duration. |
| Account assignment | Group plus permission set plus account; the unit of access. |
| Group | A named set of users; the platform expects ACME_PlatformLeads, ACME_AppDevelopers and so on. |
| Identity provider (IdP) | The external directory that can sync users and groups into Identity Center. |
| SAML | The federation standard Client VPN uses to authenticate against Identity Center. |
| Delegated administrator | The member account, core-identity, that administers Identity Center. |
Where to read more
- AWS Baseline overview for the account list the assignments target.
- IAM for the roles that permission sets become inside each account.
- STS and role assumption for what happens after sign-in.