AWS IAM Identity Center
Single sign-on (SSO)
Lets employees sign in once to multiple AWS accounts and applications, with permissions assigned by group.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?No
- Managed by AWS
- In examsCLF · SAA · SOA
Think of it asLike one employee badge that works at every company branch.
Where does IAM Identity Center fit?
Calls IAM Identity Center
IAM Identity CenterIAM Identity Center calls
A real example, step by step
- A company has 15 AWS accounts in AWS Organizations, each with its own IAM users — hard to manage.
- You enable IAM Identity Center and connect it to the Microsoft Entra ID employees already use.
- You create “Developer” and “ReadOnly” permission sets and assign them to groups on each account.
- Employees sign in once to the AWS access portal, pick an account and get temporary permissions.
- When someone leaves, disabling them in Entra ID removes their access to every AWS account.
When to use it
✓ Use it when
You have multiple AWS accounts in Organizations and a corporate identity system.
✗ Avoid it when
End users of an app → Cognito.
Common uses
- Single sign-on (SSO) for employees into multiple AWS accounts
- Connect Microsoft Entra ID, Okta, Google Workspace
- Grant permissions by group with permission sets
IAM Identity Center, IAM or Cognito?
| IAM Identity Center |  IAM |  Cognito | |
|---|---|---|---|
| For | Employees across many AWS accounts | Permissions in one account | End users of an app |
| Sign-in | Once (SSO) through the access portal | Separately in each account | The app's sign-in screen |
| User source | Built-in directory or Entra ID, Okta, AD | IAM users in the account | User pools, Google, Facebook… |
| Cost | Free | Free | Per monthly active user |
What does it cost?
- Pricing model: Free.
- Free tier: Free.
Negligible.
“Many accounts in AWS Organizations” + “single sign-on” + “use the existing user directory” → IAM Identity Center (formerly AWS SSO). Users who are customers of the app → Cognito.
Try real exam questions
1A company is migrating applications to AWS. The applications are deployed in different accounts. The company manages the accounts centrally by using AWS Organizations. The company's security team needs a single sign-on (SSO) solution across all the company's accounts. The company must continue managing the users and groups in its on-premises self-managed Microsoft Active Directory. Which solution will meet these requirements?
- AEnable AWS Single Sign-On (AWS SSO) from the AWS SSO console. Create a one-way forest trust or a one-way domain trust to connect the company's self-managed Microsoft Active Directory with AWS SSO by using AWS Directory Service for Microsoft Active Directory.
- BEnable AWS Single Sign-On (AWS SSO) from the AWS SSO console. Create a two-way forest trust to connect the company's self-managed Microsoft Active Directory with AWS SSO by using AWS Directory Service for Microsoft Active Directory.
- CUse AWS Directory Service. Create a two-way trust relationship with the company's self-managed Microsoft Active Directory.
- DDeploy an identity provider (IdP) on premises. Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console.
Show answer
Correct answer: B
AWS SSO (now IAM Identity Center) connects to the on-premises AD through AWS Managed Microsoft AD with a two-way forest trust, so users and groups stay managed in the existing AD while signing in once to every account.
Frequently asked questions
How is IAM Identity Center different from Cognito?
Identity Center is for employees and operations teams accessing AWS or internal applications. Cognito is for end users signing up and signing in to your own application.
Does IAM Identity Center cost anything?
There is no charge. You can use Identity Center's built-in user directory or connect Microsoft Entra ID, Okta or Active Directory.
What do AWS exams ask about IAM Identity Center?
Scenarios where a company with many accounts in AWS Organizations needs centralized sign-in, permission sets, and connecting an existing identity provider through SAML or SCIM.