AWS IAM Identity Center

Connection

Setup

Create an IAM user

Create an IAM user in the account your Identity Center instance runs in, and give it an access key.

Allow the actions

Attach a policy allowing the actions under Permissions.

Settings

Setting	Required	Description
Access key ID	Yes	Access key ID of the IAM user Klef signs in as.
Secret access key	Yes	Secret of that access key. Stored encrypted.
Region	Yes	Region the Identity Center instance runs in.
Role ARN		Role to assume, for an account the key was not issued in.
External ID		External ID the role’s trust policy requires. Stored encrypted.
Instance ARN		Identity Center instance ARN. Leave empty when the key reaches only one instance.

Permissions

Minimum permissions the connection requires.

Capability	Required	Granted by (any one)
Read the instance and its permission sets	Yes	`sso:ListInstances`, `sso:ListPermissionSets`, `sso:DescribePermissionSet`, `sso:ListAccountsForProvisionedPermissionSet`
Read account assignments	Yes	`sso:ListAccountAssignments`
Assign and remove permission sets	Yes	`sso:CreateAccountAssignment`, `sso:DeleteAccountAssignment`, `sso:DescribeAccountAssignmentCreationStatus`, `sso:DescribeAccountAssignmentDeletionStatus`
Resolve principals in the identity store	Yes	`identitystore:GetUserId`, `identitystore:DescribeUser`
Name the organization’s accounts		`organizations:ListAccounts`

aws_identity_center.permission_set_assignment

Fields

Field	Type	Required	Description
`principalId` (Identity store user)	reference, user	Yes	The Identity Center user, by user ID, user name or email. Names the account rather than describing it, so a diff leaves it out.
`permission_sets`	grant		Permission sets the user holds, each on one account. One row grants one permission set.
`permission_sets[]` (Permission set on account)	string		Account ID and permission set ARN, separated by \|.

Examples

Cloud access for engineers

AWS permission sets and Azure roles for engineers, read-only in production with just-in-time Contributor, removed when they leave.

stage active {
  # Each entry is one permission set on one account: <account id>|<permission set ARN>.
  target aws_identity_center.permission_set_assignment {
    principalId = worker.business_email
    permission_sets = [
      "111122223333|arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-developer0000001",
      "444455556666|arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-readonly00000001",
    ]
  }
}

Basics

Connectors

Administration

AWS IAM Identity Center

AWS IAM Identity Center

Connection

Setup

Settings

Permissions

aws_identity_center.permission_set_assignment

Fields

Examples

Cloud access for engineers

​AWS IAM Identity Center

​Connection

​Setup

​Settings

​Permissions

​aws_identity_center.permission_set_assignment

​Fields

​Examples

​Cloud access for engineers

AWS IAM Identity Center

Connection

Setup

Settings

Permissions

aws_identity_center.permission_set_assignment

Fields

Examples

Cloud access for engineers