--- cuppy_hub: aws cuppy_path: reference/identity-center/permission-sets-and-access.md cuppy_section: docs cuppy_doc: HXN9-0P8D cuppy_doc_uuid: f7d7610a-5976-4013-835b-5562ef9c0c2c cuppy_permalink: https://cuppy.io/aws/d/HXN9-0P8D cuppy_version: 4 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/aws/docs/reference/identity-center/permission-sets-and-access cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: be7497d2089c6c273484fd7fc0d488946889253e8cad9e4de7e19e08ba86da4e # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # IAM Identity Center **Identity Center is AWS's recommended way to give people access to many accounts with temporary credentials.** People sign in once to the access portal, see the accounts and roles assigned to them, and get short-term credentials for the console or the CLI. Each account-and-role choice is federated access through a role in that account: with account access manager it is an existing IAM role you own; with a permission set, Identity Center provisions it (how is not covered in the collected sources). ## The objects | Object | What it is | |---|---| | **Instance** | The Identity Center deployment. Permission sets need an **organization instance**. | | **Permission set** | A template of access: one AWS managed policy (predefined) or a custom combination of AWS managed policies, customer managed policies referenced by name, an optional inline policy and an optional permissions boundary. Its name is unique within the instance and is what users see in the portal. Optional session duration and relay state (a console URL to land on). | | **Assignment** | A user or group, plus a permission set, plus an account. A permission set does nothing until it is assigned. | | **Account access manager** (Aug 2026) | An IAM feature that assigns **existing IAM roles** in your accounts to Identity Center users and groups, keeping custom trust policies, role tags and paths. Works alongside or instead of permission sets; available in the IAM console, SDK and CloudFormation/CDK. | **Customer managed policy references need a policy of that exact name in every account** the permission set is assigned to. A missing policy in one account is a setup error for that account only. The number of managed policies in a custom permission set is bound by the IAM managed-policies-per-role quota. ## Using it from the CLI Prefer the `sso-session` configuration: it refreshes tokens automatically, and the legacy form does not. ``` aws configure sso aws sso login --profile aws sts get-caller-identity --profile aws sso logout ``` The resulting `~/.aws/config` has a `[profile ]` section with `sso_session`, `sso_account_id`, `sso_role_name`, and an `[sso-session ]` section with `sso_start_url` (or, from CLI 2.22.0, the issuer URL) and `sso_region`. From CLI 2.22.0 sign-in uses PKCE in a browser on the same device; on a machine without a browser add `--use-device-code`. Role credentials renew automatically while the Identity Center sign-in is valid; after it expires, run `aws sso login` again. Full setup: `guides/iam/local-credentials.md`. ## What changed in 2026 | When | Change | What it means for an agent | |---|---|---| | Jan 2026 | Dual-stack (IPv6) endpoints added; IPv4 endpoints remain | Dual-stack start URLs exist alongside the classic ones; both forms are valid in CLI config | | Jun 2026 | Separate quotas for AWS accounts and for applications in an instance | Adding applications no longer consumes account capacity; read current values in Service Quotas | | Jun 2026 | Customer managed applications can get programmatic AWS account access for their users, through a trusted token issuer; organization instances only, enabled by management-account or delegated administrators | An app already authenticating users through an external IdP can obtain their role credentials without a second sign-in | | Aug 2026 | Managing AWS account access is **optional** when creating a new organization instance; without it, no Identity Center service-linked role is placed in member accounts. Can be enabled later through instance settings or `UpdateInstance`. Existing instances unaffected | On a new instance, permission sets and account assignments may be unavailable until account access is turned on | | Aug 2026 | Account access manager (above) | A role a user picks in the portal may be an ordinary IAM role, not a permission-set role | | Oct 2026 | Optional network restrictions on the Identity Store API and SCIM API: only from listed VPC endpoints, source VPCs or IP ranges. Off by default; requests AWS services make on your behalf are exempt | A provisioning job or an external IdP's SCIM sync that suddenly fails may be outside the allowed networks; the IdP's published IP ranges must be allowed | ## More detail - Provisioned role names (`AWSReservedSSO_…`), session lengths and how permission-set changes reach accounts: `reference/identity-center/provisioned-roles-and-sessions.md`. - Connecting Okta, Entra ID or another IdP, SCIM, and assigning access in TypeScript: `guides/identity-center/set-up-sso.md` and `patterns/external-idp-to-identity-center.md`. - Sign-in, SCIM, CLI/SDK token and admin errors: `reference/identity-center/errors.md`. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.