AWS IAM account access manager
Centrally assign IAM roles to users and groups in your organization
What is account access manager?
AWS IAM account access manager enables your teams to create the IAM roles they need, while you control who gets access to what across your organization. Assign, audit, and update workforce access from one place, without slowing your teams down.
Account access manager works with the existing IAM roles within your organization and integrates with the users and groups you manage in AWS IAM Identity Center. You can manage who can reach which accounts, and with which role. Your workforce users authenticate through a single portal and land in the accounts they're assigned to. You can use account access manager alongside IAM Identity Center permission sets or on its own.
Key benefits of account access manager
Your teams can create and manage IAM roles tailored to their needs and move at the speed their projects demand. At the same time, you manage role assignments and see who has access to what. You give teams autonomywhile maintaining auditability.
Assign users and groups from IAM Identity Center to IAM roles across your AWS organization, all from a single management account. No more assigning access one account at a time using third-party infrastructure-as-code tools or permission sets in IAM Identity Center. With account access manager, you grant and audit access centrally.
You keep every IAM capability you already rely on, such as tagging roles for cost allocation and using IAM Access Analyzer to identify unused permissions. You can continue to use IAM Identity Center permission sets to centrally provision roles while using account access manager.
Use cases
Centralize management of entitlements
Assign users and groups from AWS IAM Identity Center to IAM roles across your AWS organization from a single console. Browse your organizational hierarchy to select accounts, map IAM roles to users or groups, and view all assignments in one place.
Decentralize ownership of IAM roles
You enable your teams to build and manage roles they need for their business, while maintaining visibility into who has access to what. Teams closest to the business define the permissions, while you retain oversight.
Works with your existing setup
If you already use permission sets, you can adopt account access manager where you want the flexibility of IAM roles, while continuing to use permission sets elsewhere. If you use direct federation, you can keep it for accounts where needed, and adopt account access manager where you want to centralize access. New customers can start with account access manager as their primary approach to workforce account access.
Did you find what you were looking for today?
Let us know so we can improve the quality of the content on our pages