IAM Identity Center

Identity Center is AWS's recommended way to give people access to many accounts with temporary credentials. People sign in once to the access portal, see the accounts and roles assigned to them, and get short-term credentials for the console or the CLI. Each account-and-role choice is federated access through a role in that account: with account access manager it is an existing IAM role you own; with a permission set, Identity Center provisions it (how is not covered in the collected sources).

The objects

Object	What it is
Instance	The Identity Center deployment. Permission sets need an organization instance.
Permission set	A template of access: one AWS managed policy (predefined) or a custom combination of AWS managed policies, customer managed policies referenced by name, an optional inline policy and an optional permissions boundary. Its name is unique within the instance and is what users see in the portal. Optional session duration and relay state (a console URL to land on).
Assignment	A user or group, plus a permission set, plus an account. A permission set does nothing until it is assigned.
Account access manager (Aug 2026)	An IAM feature that assigns existing IAM roles in your accounts to Identity Center users and groups, keeping custom trust policies, role tags and paths. Works alongside or instead of permission sets; available in the IAM console, SDK and CloudFormation/CDK.

Customer managed policy references need a policy of that exact name in every account the permission set is assigned to. A missing policy in one account is a setup error for that account only. The number of managed policies in a custom permission set is bound by the IAM managed-policies-per-role quota.

Using it from the CLI

Prefer the sso-session configuration: it refreshes tokens automatically, and the legacy form does not.

aws configure sso
aws sso login --profile <profile>
aws sts get-caller-identity --profile <profile>
aws sso logout

The resulting ~/.aws/config has a [profile <name>] section with sso_session, sso_account_id, sso_role_name, and an [sso-session <name>] section with sso_start_url (or, from CLI 2.22.0, the issuer URL) and sso_region. From CLI 2.22.0 sign-in uses PKCE in a browser on the same device; on a machine without a browser add --use-device-code. Role credentials renew automatically while the Identity Center sign-in is valid; after it expires, run aws sso login again. Full setup: guides/iam/local-credentials.md.

What changed in 2026

When	Change	What it means for an agent
Jan 2026	Dual-stack (IPv6) endpoints added; IPv4 endpoints remain	Dual-stack start URLs exist alongside the classic ones; both forms are valid in CLI config
Jun 2026	Separate quotas for AWS accounts and for applications in an instance	Adding applications no longer consumes account capacity; read current values in Service Quotas
Jun 2026	Customer managed applications can get programmatic AWS account access for their users, through a trusted token issuer; organization instances only, enabled by management-account or delegated administrators	An app already authenticating users through an external IdP can obtain their role credentials without a second sign-in
Aug 2026	Managing AWS account access is optional when creating a new organization instance; without it, no Identity Center service-linked role is placed in member accounts. Can be enabled later through instance settings or `UpdateInstance`. Existing instances unaffected	On a new instance, permission sets and account assignments may be unavailable until account access is turned on
Aug 2026	Account access manager (above)	A role a user picks in the portal may be an ordinary IAM role, not a permission-set role
Oct 2026	Optional network restrictions on the Identity Store API and SCIM API: only from listed VPC endpoints, source VPCs or IP ranges. Off by default; requests AWS services make on your behalf are exempt	A provisioning job or an external IdP's SCIM sync that suddenly fails may be outside the allowed networks; the IdP's published IP ranges must be allowed

More detail

Provisioned role names (AWSReservedSSO_…), session lengths and how permission-set changes reach accounts: reference/identity-center/provisioned-roles-and-sessions.md.
Connecting Okta, Entra ID or another IdP, SCIM, and assigning access in TypeScript: guides/identity-center/set-up-sso.md and patterns/external-idp-to-identity-center.md.
Sign-in, SCIM, CLI/SDK token and admin errors: reference/identity-center/errors.md.