AWS IAM Identity Center Hands-On Configuration – SAP-C02 Study Guide

Purpose of This Lesson

AWS IAM Identity Center provides centralized workforce access to AWS accounts and applications. This lesson demonstrates the basic configuration flow: enable Identity Center, select an identity source, create users and groups, define permission sets, assign access to an AWS account, and sign in through the access portal.

The same concepts apply to larger multi-account environments, although production deployments commonly use an external identity provider or Active Directory instead of the built-in Identity Center directory.

Key Concepts

AWS Organizations integration

IAM Identity Center is designed to provide centralized access across an AWS organization. AWS Organizations supplies the account structure, while Identity Center manages workforce identities and their access to those accounts.

An organization can provide:

• Centralized billing
• A hierarchy of AWS accounts
• Central governance through policies such as service control policies (SCPs)
• A target structure for assigning Identity Center access

For a basic lab, an organization with one account is sufficient. In an enterprise environment, Identity Center can expose multiple member accounts and organizational units through a central access portal.

Identity sources

Identity Center needs an identity source for users and groups. Common options include:

• The built-in Identity Center directory
• An external identity provider (IdP)
• Microsoft Active Directory or AWS Directory Service integrations

The identity source determines where users authenticate and where identity lifecycle management occurs. Changing the identity source is an architectural decision, not merely a user-interface preference. Organizations commonly use an existing corporate IdP to centralize authentication, federation, and employee lifecycle processes.

Permission sets

A permission set is a reusable definition of permissions and session settings. It is not the same as an IAM user or a standalone IAM policy.

When a permission set is assigned to a user or group for an AWS account, Identity Center provisions the corresponding IAM role in that account. The user then assumes that role through the access portal or supported command-line workflows.

Permission sets can be based on AWS managed policies or customized with inline and customer-managed policies. Typical examples include:

• AdministratorAccess for tightly controlled administrative users
• ViewOnlyAccess for read-only investigation and monitoring
• Custom least-privilege roles for operations, security, finance, or application teams

A single user or group can receive multiple permission sets for the same account. The user selects the required access level when signing in.

Users, groups, and assignments

A scalable access model generally follows this chain:

User → Group → Permission set → AWS account

Groups simplify administration because access can be changed for an entire team rather than for individual users. For example, a management group might be assigned both administrative and read-only permission sets in a lab, although production access should normally follow least privilege and separation of duties.

The account assignment is the point at which access becomes effective. Creating a user or permission set alone does not grant access to an AWS account.

Access portal and authentication

The IAM Identity Center access portal provides a central sign-in location. After authentication, a user can select:

• An AWS account
• A permission set
• The AWS Management Console or command-line access, where available

MFA can be required during authentication. In a new-user workflow, the user typically accepts an invitation, establishes a password if using the built-in directory, registers an authenticator application, and then signs in through the portal.

Identity Center also exposes authentication and session settings, including the default session duration. Session duration should balance usability with security requirements.

Exam-Relevant Takeaways

• IAM Identity Center is the AWS service for centralized workforce access across AWS accounts and supported applications.
• Identity Center integrates with AWS Organizations to present the organization’s accounts for centralized assignment and access management.
• A permission set defines the permissions and session configuration used when a user accesses an AWS account.
• Identity Center provisions IAM roles into target accounts from permission set assignments; users do not normally need individual IAM users in every account.
• Assigning a permission set to a group is generally more maintainable than assigning it separately to many users.
• A user, group, permission set, and target AWS account must be connected before access is available.
• The built-in Identity Center directory is suitable for simple environments and labs; an external IdP or directory is often preferred for enterprise identity lifecycle integration.
• MFA configuration is part of the Identity Center authentication model and should be enabled according to organizational security requirements.
• The access portal is the normal entry point for selecting an account and permission set.
• Identity Center access does not override AWS Organizations SCPs. An SCP can restrict the maximum permissions available to a role, including a role provisioned by Identity Center.

Architecture Decision Guide

Requirement	Recommended approach	Reasoning
Small lab or proof of concept	Built-in Identity Center directory	Fast to configure with minimal dependencies
Existing corporate authentication	External identity provider	Reuses centralized authentication, MFA, and joiner/mover/leaver processes
Multiple AWS accounts	Integrate Identity Center with AWS Organizations	Centralizes account visibility and access assignments
Access for an entire department	Group-based assignment	Reduces repetitive administration and improves consistency
Temporary read-only investigation	ViewOnlyAccess or a custom read-only permission set	Limits accidental changes while allowing visibility
Broad administrative access	Restricted administrator permission set	Centralizes powerful access and makes it auditable; use sparingly
Different access levels in one account	Multiple permission sets	Users select the appropriate role for the task
Organization-wide preventive controls	AWS Organizations SCPs	Limits maximum permissions across accounts; does not grant permissions by itself

Common Exam Traps

• Confusing Identity Center with IAM users: Identity Center manages workforce access centrally. It is not simply a console for creating IAM users in every account.
• Assuming a permission set grants access automatically: A permission set must be assigned to a user or group for a specific AWS account.
• Treating a permission set as a policy only: Identity Center uses the permission set to provision an IAM role in the target account.
• Forgetting the identity source: Users must exist in the configured Identity Center directory or be supplied by the selected external identity system.
• Assuming SCPs grant permissions: SCPs establish permission boundaries for accounts or organizational units. IAM policies and assumed roles still determine what actions are allowed within those boundaries.
• Using administrator access for routine work: A user may have multiple permission sets, but operational tasks should use the least-privileged option.
• Assuming MFA is automatically sufficient for every requirement: MFA settings, trusted token issuers, session duration, and the external IdP’s controls must be evaluated together.
• Confusing the access portal with the AWS console URL: The portal is the centralized sign-in location where users choose an account and permission set.

Real-World Engineer Notes

• Use groups that represent job functions rather than creating one-off user assignments.
• Prefer custom permission sets for production roles. AWS managed policies such as AdministratorAccess and ViewOnlyAccess are useful for demonstrations and broad baseline roles but may be too permissive for real workloads.
• Separate human access from workload access. Applications should generally use IAM roles, workload identity, or other service-to-service mechanisms rather than human Identity Center users.
• Use an external IdP when the organization already has centralized identity governance, conditional access, device controls, or automated employee deprovisioning.
• Keep administrative access tightly controlled and consider separate permission sets for production, nonproduction, security, and audit functions.
• Review session duration and MFA requirements against risk. Long sessions improve convenience but increase exposure if a session or endpoint is compromised.
• In multi-account designs, combine Identity Center assignments with SCPs, permission boundaries where appropriate, CloudTrail, and centralized security monitoring.
• The management account should not become the default location for routine workloads. Even when it is visible in Identity Center, production designs generally limit use of the management account and apply strong governance controls.

Quick Reference Summary

• Enable AWS Organizations before configuring organization-wide Identity Center access.
• Enable IAM Identity Center and confirm the identity source.
• Configure authentication settings, including MFA and session behavior.
• Create users and groups, or connect an external identity provider.
• Create reusable permission sets.
• Assign users or groups to permission sets for specific AWS accounts.
• Use the access portal to select the account, permission set, and access method.
• Remember that SCPs restrict permissions but do not grant them.
• Apply least privilege and prefer group-based administration.

Flashcards

1. Q: What is the primary purpose of IAM Identity Center?

A: To centrally manage workforce access to AWS accounts and supported applications.

1. Q: What AWS service commonly provides the account structure integrated with Identity Center?

A: AWS Organizations.

1. Q: What is a permission set?

A: A reusable definition of permissions and session settings that Identity Center uses to provide access to an AWS account.

1. Q: What does Identity Center provision in a target AWS account when access is assigned?

A: An IAM role based on the permission set.

1. Q: Why are groups preferred over many individual assignments?

A: Group membership and group-level assignments simplify administration and provide consistent access for a team.

1. Q: What is the normal user entry point for Identity Center access?

A: The IAM Identity Center access portal.

1. Q: Name two possible Identity Center identity sources.

A: The built-in Identity Center directory and an external identity provider; Active Directory integrations are another option.

1. Q: Does creating a permission set alone grant access to an AWS account?

A: No. The permission set must be assigned to a user or group for a specific account.

1. Q: What does ViewOnlyAccess typically provide?

A: Broad read-only visibility without normal resource modification permissions.

1. Q: What is the relationship between an SCP and an Identity Center permission set?

A: The SCP can restrict the maximum permissions available to the role created from the permission set, but it does not grant permissions.

Practice Questions

Question 1

A company has 20 AWS accounts in AWS Organizations. It wants employees to use their corporate identities to access accounts through a central portal. Administrators should be able to assign access by team and avoid creating IAM users in every account. Which solution best meets the requirement?

A. Create IAM users in each account and synchronize passwords manually
B. Deploy IAM Identity Center integrated with AWS Organizations and an external identity provider
C. Create one IAM user in the management account and share its credentials
D. Use an SCP to grant employees console access

Correct answer: B

Explanation: IAM Identity Center provides centralized workforce access, integrates with AWS Organizations, supports groups and permission sets, and can use an external corporate identity provider. SCPs do not grant access, and shared credentials are insecure.

Question 2

A security team needs to grant an investigator read-only access to one AWS account. The investigator should not be able to create, modify, or delete resources. What is the most appropriate Identity Center configuration?

A. Assign AdministratorAccess and rely on CloudTrail to detect changes
B. Create or use a read-only permission set and assign it to the investigator for the target account
C. Add the investigator to the organization management account root user
D. Attach an SCP that allows read-only actions to the investigator

Correct answer: B

Explanation: A read-only permission set, such as one based on ViewOnlyAccess, directly limits the user’s effective role permissions. SCPs constrain permissions but do not grant them.

Question 3

An administrator creates a Developer permission set and a Developers group but a group member cannot see the target AWS account in the access portal. What is the most likely missing step?

A. The user needs a second root account
B. The permission set must be assigned to the group for the target AWS account
C. The organization must be deleted and recreated
D. The user must receive the AdministratorAccess policy directly

Correct answer: B

Explanation: Creating the identity, group, and permission set does not grant account access. The group must be assigned the permission set for the specific AWS account.

Question 4

An organization already uses a corporate IdP that enforces MFA, device compliance, and automated employee deprovisioning. Which Identity Center design is most appropriate?

A. Use the built-in directory and manually recreate every employee
B. Use the corporate IdP as the Identity Center identity source
C. Disable MFA because the AWS console has a password
D. Store all employee credentials in AWS Secrets Manager

Correct answer: B

Explanation: Integrating the existing IdP preserves centralized authentication and lifecycle controls. The exact MFA behavior should be designed across the IdP and Identity Center configuration rather than assuming one replaces the other.

Question 5

A user has an administrator permission set assigned in an AWS account, but an organization SCP denies ec2:TerminateInstances. What happens when the user attempts to terminate an instance?

A. The permission set always overrides the SCP
B. The action is allowed because the user authenticated with MFA
C. The action is denied because the SCP limits the maximum permissions available
D. The instance is terminated only if the user uses the access portal

Correct answer: C

Explanation: An SCP establishes the maximum permissions available to principals in an account or organizational unit. An explicit SCP denial prevents the action even when the Identity Center permission set grants administrator-level IAM permissions.