Certablo
Sign inCreate account
← Knowledge Base
Security & Identityservice

IAM Identity Center & Workforce Federation

Central workforce access to AWS accounts and applications: identity sources, SAML/SCIM federation, permission sets and the IAM roles that turn a workforce assignment into temporary AWS account access.

CLF-C02AIF-C01SAA-C03

Visual overview

DEFENSE IN DEPTHIdentity, data, network, detection, and audit controls protect different boundaries
IDENTITYAuthenticate + authorizePrincipals · policies · temporary credentials
DATAEncrypt + protect secretsKeys · certificates · application secrets
DETECT & AUDITFind threats + retain evidenceFindings · API history · configuration state
No single security service replaces the others. Strong AWS security combines preventive, detective, and evidence-producing controls around the workload.
AWS SERVICE MAPWorkforce access chain

Identity Center centralizes users and assignments, provisions IAM role permissions into member accounts, and can use Organizations as the multi-account boundary.

IAM Identity CenterWorkforce identity and account assignments
OrganizationsMulti-account structure
IAM rolesProvisioned account permissions
EXAM-RELEVANT MECHANICS

Technical reference

Identity Center separates identity source, assignment, and resulting AWS account role so each stage can be governed independently.

Authentication federationSAML 2.0

External IdPs can authenticate workforce users by sending standards-based SAML assertions.

Identity provisioningSCIM

Supported external IdPs can synchronize users and groups through the SCIM provisioning protocol.

Authorization templatePermission set

Defines the permissions Identity Center should provision for an account assignment.

Account implementationIdentity Center-managed IAM role

Assigning a permission set causes IAM Identity Center to create and maintain corresponding IAM roles and policies in target accounts.

Assignment tupleUser/group + account + permission set

Useful account access exists only after identity, target account, and permissions are connected by an assignment.

Workforce identities should not become fleets of IAM users

AWS IAM Identity Center is designed to connect workforce users to AWS accounts and supported applications. An organization can use the Identity Center directory or connect an existing identity source. This separates corporate identity lifecycle from individual AWS accounts: onboarding, group membership, and offboarding can be managed centrally instead of creating a separate long-term IAM user in every account.

For external identity providers, IAM Identity Center supports SAML 2.0 for authentication federation and SCIM for automated provisioning of users and groups in supported configurations. These protocols solve different parts of the problem: SAML carries authentication assertions for sign-in, while SCIM synchronizes identity objects and group membership. A successful login still needs an AWS account or application assignment before the person gains useful access.

Permission sets translate job functions into AWS account access

A permission set defines a collection of permissions that can be assigned to users or groups for one or more AWS accounts. The permission set is stored centrally in IAM Identity Center. When assigned to an AWS account, Identity Center creates and manages corresponding IAM roles in that account and applies the policies represented by the permission set. Authorized users then access those role-backed permissions through the AWS access portal, CLI, or supported flows.

Users can receive more than one permission set for the same account, which is useful when an administrator normally works with read-only or operations permissions and elevates only when an administrative task requires it. The assignment model is therefore identity or group → account → permission set, rather than identity → permanent IAM credentials. That makes account access easier to review across an AWS Organization.

Federation changes where identity is managed, not the need for authorization

Identity Center does not bypass IAM policy evaluation. After a user is authenticated and receives account access, the provisioned IAM role and its policies still define AWS API permissions, while SCPs and other guardrails can constrain them. MFA and authentication strength are normally enforced through the selected identity source and Identity Center configuration according to the organization's architecture.

For machine-to-machine access, workforce Identity Center is generally not the credential source to reach for. AWS recommends role-based short-term credentials for AWS workloads and other workload identity mechanisms for machines. This distinction prevents a common design error: human SSO and workload authentication both use temporary access concepts, but they serve different identity populations and lifecycle requirements.

Key takeaways

  1. 01

    IAM Identity Center centralizes workforce access to AWS accounts and supported applications.

  2. 02

    SAML 2.0 is used for workforce authentication federation; SCIM can provision and synchronize users and groups.

  3. 03

    Permission sets are centrally defined and are provisioned as Identity Center-controlled IAM roles in assigned AWS accounts.

  4. 04

    Authentication through Identity Center does not bypass IAM authorization or Organizations guardrails.

  5. 05

    Human workforce access and workload machine authentication should use identity mechanisms designed for their different lifecycles.

Official AWS sources

Use these primary AWS resources for the source material behind this article and for deeper reference.