AWS IAM Identity Center

Overview

AWS IAM Identity Center is Amazon's free service for giving a workforce single sign-on into AWS accounts and AWS managed applications, and it is the default answer for any organization running more than a handful of AWS accounts. It was called AWS Single Sign-On until AWS renamed it on 26 July 2022; the sso and identitystore API namespaces kept their old names. It is an AWS service, not a separate company. Identity Center connects to one identity source (its own directory, Active Directory, or an external SAML 2.0 IdP such as Okta or Microsoft Entra ID) and maps those users and groups onto AWS roles.

What it is good at

Multi-account AWS access is the core job, and it does it well. Permission sets define a role once (for example "ReadOnly" or "Billing") and provision it into every account in AWS Organizations you assign, replacing hand-built IAM roles and long-lived access keys. The AWS CLI v2 signs in through Identity Center and receives short-lived credentials (60 minutes per the FAQ), a real improvement over static keys on laptops. Users and groups sync in over SCIM 2.0 from Okta, Entra ID, OneLogin and PingFederate, and attributes from the IdP can drive ABAC through session tags. MFA options include FIDO2/WebAuthn security keys, built-in biometrics and TOTP when Identity Center or AD is the source. Trusted identity propagation passes the user's identity between AWS managed applications such as Amazon Quick and Amazon Redshift, so CloudTrail records the person rather than a shared role. Organization instances can now be replicated to additional Regions, removing the old single-Region availability risk.

Where it falls short

It is an AWS access broker, not a workforce IdP. Only one identity source can be connected at a time. Customer managed application SSO is SAML 2.0 only and browser-only; OAuth 2.0 applies to trusted identity propagation, not to general OIDC app sign-in. There is no outbound SCIM to SaaS apps, no access certification, no lifecycle workflows and no device posture. Multi-Region replication requires an organization instance, a multi-Region customer managed KMS key, and an IdP that supports multiple ACS URLs (AWS lists Google Workspace as one that does not), and it is unavailable with Active Directory as the source. Permission-set sprawl across hundreds of accounts becomes its own governance problem, which is where CIEM and IGA tools come in.

Pricing

No extra charge, per AWS. The cost sits in the primary IdP you federate to it. Published rates like this are the exception, as the Identity Pricing Transparency Index 2026 shows.

Best for, and who should look elsewhere

Turn it on if you have more than one AWS account: deployment is measured in days, and the hard part is designing permission sets, not wiring SSO. Do not try to make it your company IdP; pick one from the IAM rankings or Okta vs Microsoft Entra and federate it in. Multi-cloud teams will still need a separate answer for Azure and Google Cloud, covered in the multi-cloud IAM strategy guide.

Bottom line

Every AWS Organization should use Identity Center for human access to accounts, with a real IdP behind it. Its value is replacing long-lived IAM users and keys with short-lived, centrally assigned roles, not replacing your workforce identity platform.