AWS IAM Identity Center in Action: Organizations, Permission Sets, and Access Portal

Purpose of This Lesson

This lesson demonstrates how to enable AWS IAM Identity Center for an AWS Organization and configure centralized user access. The workflow covers the identity source, permission sets, groups, users, account assignments, MFA registration, and using the access portal to select an account, permission set, and access method.

The main operational goal is to provide centrally managed access to AWS accounts without configuring separate IAM users in each account.

Key Concepts

• AWS Organizations: Provides the organization structure that IAM Identity Center integrates with. The demonstration uses an organization with a management account.
• IAM Identity Center: Centrally manages workforce identities and access to AWS accounts and applications.
• Identity source: The directory used for IAM Identity Center identities. The walkthrough uses the built-in Identity Center directory, while the console also supports changing to an external directory or identity provider.
• Permission set: A reusable definition of permissions that can be assigned to users or groups for a specific AWS account. The demonstration creates predefined AdministratorAccess and ViewOnlyAccess permission sets.
• Group-based assignment: A group can be assigned to an account with one or more permission sets. Users inherit the assigned access through their group membership.
• Access portal: The user-facing URL where users authenticate, choose an AWS account, select a permission set, and open either the AWS Management Console or a command-line access option.
• MFA: IAM Identity Center can be configured for multi-factor authentication. In the walkthrough, the user registers an authenticator app during initial sign-in.

Configuring IAM Identity Center with AWS Organizations

1. Create or confirm the organization

IAM Identity Center is integrated with AWS Organizations. If an organization does not already exist, create one in the AWS Organizations console. Organizations can support centralized billing, account management, and policies such as service control policies, although those capabilities are outside this demonstration.

The important prerequisite for this workflow is having the organization enabled so that IAM Identity Center can use its account structure.

2. Enable IAM Identity Center

From the AWS console, open IAM Identity Center and enable it. After activation, the console provides configuration areas for:

• Confirming the identity source
• Managing authentication settings
• Creating permission sets
• Assigning users and groups to accounts
• Managing applications and related settings
• Viewing the access portal URL

The example retains the IAM Identity Center directory as the identity source. The console also exposes options for external directory systems, such as Active Directory, or an external identity provider.

3. Review authentication and management settings

The Identity Center configuration includes settings for:

• Multi-factor authentication
• Trusted token issuers
• Session duration
• Changing the identity source
• Creating a delegated administrator
• Deleting the Identity Center configuration

The demonstration leaves the default session duration at eight hours. Treat this as the configuration shown in the lesson, not as a universal requirement for every environment.

4. Create permission sets

Create reusable permission sets before assigning access:

1. Open the permission-set management area.
2. Choose to create a permission set.
3. Select a predefined permission set or create a custom one.
4. Create AdministratorAccess for broad administrative access.
5. Create ViewOnlyAccess for read-only exploration and inspection.

A permission set is not useful to a user until it is assigned to that user or the user’s group for an AWS account.

5. Create a group and user

The demonstration creates a group named management and creates a user with an email address, first name, and last name. During user creation, the user is added to the management group.

This establishes the identity relationship:

> User → Group → AWS account assignment → Permission set

Using groups makes it easier to manage access consistently for multiple users.

6. Assign the group to an AWS account

From the AWS accounts area:

1. Select the target account, which is the management account in the walkthrough.
2. Choose Assign users or groups.
3. Select the management group.
4. Select both AdministratorAccess and ViewOnlyAccess.
5. Submit the assignment.

The group now has two available permission sets for that account, and the user receives those options because the user belongs to the group.

7. Complete user activation and MFA registration

The user receives an invitation email. The activation process includes:

1. Selecting Accept invitation.
2. Setting a new password.
3. Signing in with the new credentials.
4. Registering an MFA device using an authenticator application.
5. Scanning the displayed QR code and entering the generated code.

After MFA registration, the user can access the portal and view the accounts and permission sets assigned to them.

8. Use the access portal

The access portal URL is visible in the IAM Identity Center dashboard. Users can bookmark it for future access.

After signing in, the user selects:

1. An AWS account
2. A permission set, such as ViewOnlyAccess or AdministratorAccess
3. An access method, such as the AWS Management Console or command line

The resulting session reflects the selected permission set. For example, entering the console through ViewOnlyAccess displays that access context and limits the user to the permissions granted by that set. Returning to the portal and selecting AdministratorAccess starts a separate session with broader permissions.

Exam- or Assessment-Relevant Takeaways

• IAM Identity Center integrates with AWS Organizations to provide centralized account access.
• A permission set defines the access a user or group receives in an AWS account.
• Users can receive permission sets indirectly through group membership.
• The assignment path matters: the group must be assigned to the account and associated with the required permission set.
• A user may have multiple permission sets for the same account, such as administrator and view-only access.
• The access portal is where the user chooses the account, permission set, and console or command-line access method.
• Identity Center can use its own directory or be configured with an external identity source.
• MFA configuration and session settings are managed within IAM Identity Center.
• Do not confuse an organization’s general capabilities, such as centralized billing or service control policies, with the permission sets that grant user access.

Tool / Feature Decision Guide

Requirement	Appropriate choice	Reason
Provide broad administrative access for a trusted operator	AdministratorAccess permission set	Supplies the broad permissions demonstrated in the lesson; use only when that access level is justified.
Let a user inspect resources without changing them	ViewOnlyAccess permission set	Supports read-only access for investigation or observation.
Give the same access to several users	Assign a group to the account and permission set	Users inherit access through group membership, simplifying administration.
Let users choose among several access levels	Assign multiple permission sets to the account	The user selects the appropriate permission set at the access portal.
Use an existing corporate directory	Change the identity source	IAM Identity Center supports integration with an external directory or identity provider.
Require an additional authentication factor	Configure MFA and register an authenticator app	Adds MFA to the user sign-in workflow shown in the demonstration.
Start an AWS console session	Choose Management Console in the access portal	Opens the selected account using the selected permission set.
Obtain command-line access	Choose the command-line option in the access portal	Uses the portal’s command-line access path instead of the console.

Common Traps / Misconceptions

• Creating a user is not the same as granting account access. The user must belong to a group or otherwise be assigned access, and that identity must have a permission set assignment for the target account.
• A permission set is not automatically applied to every account. The group or user must be assigned to each required AWS account.
• Multiple permission sets do not merge into one user-selected role automatically. The user chooses which assigned permission set to use when launching access.
• The organization and Identity Center have different responsibilities. Organizations supplies the account structure; Identity Center manages workforce sign-in and account access assignments.
• ViewOnlyAccess is not administrative access. A user can see resources but should not be assumed to have permission to modify them.
• The access portal is not merely a documentation URL. It is the sign-in and access-selection entry point for Identity Center users.
• MFA registration is part of the user activation flow shown here. Do not treat successful password creation as the end of onboarding.
• The management account is only the example target. The same assignment workflow should be evaluated carefully before granting access to highly privileged accounts.

Real-World Engineer / Analyst Notes

• Prefer group-based assignments when several users need the same access pattern. This reduces one-off configuration and makes reviews easier.
• Create separate permission sets for distinct responsibilities instead of giving every user administrator access.
• Encourage users to choose ViewOnlyAccess when they only need to inspect resources or troubleshoot without making changes.
• Bookmark the access portal URL and document it as part of the onboarding process.
• Review the identity source, MFA settings, trusted token issuers, and session duration as part of an operational security baseline.
• Be deliberate when assigning permissions to the management account. Broad administrative access there has a much larger impact than access to a limited workload account.
• When troubleshooting missing access, trace the complete chain: user membership, group-to-account assignment, permission-set assignment, invitation activation, and selected portal session.
• The console can show multiple permission sets for the same account. Confirm which one was selected before diagnosing an apparent permissions problem.

Quick Reference Summary

• Create or use an AWS Organization.
• Enable IAM Identity Center.
• Confirm the identity source, using the built-in directory or an external source.
• Create permission sets such as AdministratorAccess and ViewOnlyAccess.
• Create groups and users, then place users in the appropriate groups.
• Assign the group to an AWS account with one or more permission sets.
• Activate the user through the invitation email and configure MFA.
• Use the access portal to select the account, permission set, and console or command-line access method.
• Diagnose access through the assignment chain rather than by checking only the user object.

Flashcards

Q: What AWS service structure must be available before integrating IAM Identity Center for centralized account access?

A: An AWS Organization must be created or already available. IAM Identity Center uses the organization’s account structure for account assignments.

Q: A team needs identical access to an AWS account. Should each user be assigned separately?

A: Prefer assigning the group to the account with the required permission set, then adding users to the group. This centralizes access management.

Q: What is the difference between a permission set and a user account in IAM Identity Center?

A: The user account represents the identity; the permission set defines the permissions that identity receives when accessing a particular AWS account.

Q: A user belongs to the management group but cannot see the target AWS account in the access portal. What relationship should be checked first?

A: Verify that the management group was assigned to that AWS account and that at least one permission set was included in the assignment.

Q: When would a user choose ViewOnlyAccess instead of AdministratorAccess?

A: The user should choose ViewOnlyAccess when they only need to inspect resources or investigate an environment without making changes. AdministratorAccess should be reserved for tasks that require broad administrative permissions.

Q: Can one group have multiple permission sets assigned for the same account?

A: Yes. In the walkthrough, the management group receives both AdministratorAccess and ViewOnlyAccess for the account.

Q: Where does an IAM Identity Center user choose the account and permission level for a session?

A: The user signs in through the IAM Identity Center access portal, selects an AWS account, and then chooses an assigned permission set.

Q: What access methods are available from the access portal in the demonstration?

A: The user can choose the AWS Management Console or a command-line access option after selecting the account and permission set.

Q: What identity source is used in the walkthrough, and what alternative is supported?

A: The walkthrough uses the IAM Identity Center directory. The identity source can instead be changed to an external directory system or identity provider.

Q: What is the purpose of registering an authenticator application during onboarding?

A: It provides an MFA device for the user’s sign-in process. The user scans a QR code and enters a generated code to complete registration.

Q: What session duration is left unchanged in the demonstration?

A: The default session duration is left at eight hours. The lesson does not establish that this value is appropriate for every environment.

Q: A user launches the console and sees ViewOnlyAccess in the upper-right context. What does that indicate?

A: The session was launched using the ViewOnlyAccess permission set, so the session has the permissions associated with that set rather than administrator permissions.

Q: What is the operational difference between AWS Organizations and IAM Identity Center in this workflow?

A: Organizations provides the multi-account structure and account integration point. IAM Identity Center manages user authentication and permission-set-based access to those accounts.

Q: What should an engineer trace when an Identity Center user has insufficient permissions?

A: Check the user’s group membership, the group-to-account assignment, the assigned permission set, and the permission set selected in the portal session.

Practice Questions

Question 1

A company has created an AWS Organization and enabled IAM Identity Center. A user has been created and added to a group, but the user sees no AWS accounts after signing in to the access portal. What is the most likely missing configuration?

A. The user needs a second email address

B. The group has not been assigned to an AWS account with a permission set

C. The user must create a service control policy

D. The organization must enable centralized billing

Correct answer: B

The user’s group must be assigned to the target account and associated with one or more permission sets before the account appears as an available access target.

Question 2

An analyst needs to inspect resources in an account but must not modify them. Which access option from the configured portal is most appropriate?

A. AdministratorAccess through the Management Console

B. ViewOnlyAccess through the Management Console

C. AdministratorAccess through the command line

D. A new AWS Organization

Correct answer: B

ViewOnlyAccess is the predefined read-only option demonstrated in the lesson and is the better fit for inspection without administrative changes.

Question 3

A department has ten users who require the same two access levels in one AWS account. Which configuration minimizes repeated identity assignments while preserving both choices?

A. Create ten separate organizations

B. Assign each user only to the management account

C. Add the users to a group and assign that group both permission sets for the account

D. Give the users administrator permissions through local IAM users in the account

Correct answer: C

Group-based assignment lets all members inherit the account access and exposes both assigned permission sets as choices in the access portal.

Question 4

A user successfully sets a password from the invitation email but is prompted to register an authenticator application at first sign-in. What should the user do?

A. Delete the Identity Center configuration

B. Scan the displayed QR code and enter the generated MFA code

C. Create a service control policy

D. Change the AWS Organization identity source immediately

Correct answer: B

The demonstrated onboarding flow registers an MFA device by scanning the QR code and submitting the current code from the authenticator application.

Question 5

An engineer needs to perform a task using elevated permissions but normally investigates incidents with read-only access. What is the correct Identity Center workflow?

A. Always use AdministratorAccess because the user has both permission sets

B. Launch the account from the access portal and select the permission set appropriate to the current task

C. Change the organization’s billing configuration

D. Create a new user in every account before each task

Correct answer: B

The access portal presents the assigned permission sets, allowing the engineer to choose ViewOnlyAccess for investigation and AdministratorAccess only when the task requires it.

WordPress Metadata

Suggested Slug:
aws-iam-identity-center-organizations-permission-sets-access-portal

Meta Description:
Study how AWS IAM Identity Center integrates with AWS Organizations to assign permission sets, groups, MFA, and console or command-line access through the access portal.

Tags:
AWS IAM Identity Center, AWS Organizations, IAM permission sets, AWS access portal, AWS IAM groups, AWS MFA, AWS security, AWS centralized access, AWS CloudOps, AWS SOA-C03