AWS Launches Account Access Manager for Centralized IAM Role Assignments
Summary
AWS Account Access Manager lets organizations assign existing IAM roles to IAM Identity Center users and groups, combining centralized workforce access with role flexibility and user-level visibility into role sessions.
Key points
- Administrators can assign existing account-specific IAM roles to IAM Identity Center users or groups through centralized entitlements.
- The service carries user identity into role sessions, enabling user-level attribution and auditing even when users assume shared roles.
- Existing IAM capabilities remain available, including ABAC with role or session tags, custom trust policies, and role paths.
- Role trust policies must allow the account access manager service; AWS recommends source-account and application-ARN conditions for confused-deputy protection.
- Administrators can manage assignments through the console, API, AWS CLI, SDKs, CloudFormation, Terraform, and Pulumi.
- Workforce users can access assigned roles through the portal or with the AWS CLI aws login command; assigned role sessions can last up to 12 hours.
- AWS says the service is available at no additional cost and enabled by default in most Commercial Regions, with listed regional exclusions.
Article Details
- Event Type
- AWS product and service launch
- Impact
- AWS introduced account access manager to centrally assign existing IAM roles to IAM Identity Center users and groups. The service combines centralized workforce federation with IAM role flexibility and provides user-level visibility and auditability across AWS accounts. AWS says it is available at no additional cost and enabled by default in Commercial Regions, with the exclusions stated in the article.
Vendors
Amazon Web ServicesAWS Identity and Access Management (IAM) is introducing account access manager, a flexible new way to manage workforce access to your Amazon Web Services (AWS) accounts.AponoAlongside them, access-governance and privileged-access partners Apono, BeyondTrust, Britive, Sonrai Security, C1.ai and Lumos added capabilities to govern, provision, and audit that access through the tooling ourBeyondTrustAlongside them, access-governance and privileged-access partners Apono, BeyondTrust, Britive, Sonrai Security, C1.ai and Lumos added capabilities to govern, provision, and audit that access through the tooling ourBritiveAlongside them, access-governance and privileged-access partners Apono, BeyondTrust, Britive, Sonrai Security, C1.ai and Lumos added capabilities to govern, provision, and audit that access through the tooling ourC1.aithem, access-governance and privileged-access partners Apono, BeyondTrust, Britive, Sonrai Security, C1.ai and Lumos added capabilities to govern, provision, and audit that access through the tooling our customersCisco DuoLeading identity providers Okta, PingIdentity and Cisco Duo extend account access manager so customers can manage human workforce access to AWS accounts directly from the identity platforms they already use.Lumosaccess-governance and privileged-access partners Apono, BeyondTrust, Britive, Sonrai Security, C1.ai and Lumos added capabilities to govern, provision, and audit that access through the tooling our customers alreadyOktaIn addition, if you use a supported IdP, such as Okta, Microsoft Entra ID, or Ping Identity, you can add the account access portal as a bookmark app in the IdP’s dashboard, giving users authenticated, single-clickPing IdentityLeading identity providers Okta, PingIdentity and Cisco Duo extend account access manager so customers can manage human workforce access to AWS accounts directly from the identity platforms they already use.Pulumilogin and the account-access API namespace), AWS SDKs, AWS CloudFormation, and HashiCorp Terraform and Pulumi, so you can enable it and manage role assignments the same way you manage the rest of your AWSSonrai SecurityAlongside them, access-governance and privileged-access partners Apono, BeyondTrust, Britive, Sonrai Security, C1.ai and Lumos added capabilities to govern, provision, and audit that access through the tooling our
Products
account access managerAWS Identity and Access Management (IAM) is introducing account access manager, a flexible new way to manage workforce access to your Amazon Web Services (AWS) accounts.IAMAWS Identity and Access Management (IAM) is introducing account access manager, a flexible new way to manage workforce access to your Amazon Web Services (AWS) accounts.IAM Identity CenterThis combines the IAM role flexibility your teams already rely on, delivered through the centralized federation of AWS IAM Identity Center, with user-level visibility built-in.