IAM Role Assignment Just Got Way Easier: Meet Account Access Manager

Hi everyone, Shii-chan here! Today's news is great for anyone running AWS across multiple accounts, IAM role management just got a bit easier.

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, AWS Identity and Access Management (IAM) just launched a new feature called account access manager. Administrators can now assign the IAM roles inside their AWS accounts directly to workforce users and groups managed in AWS IAM Identity Center. You can set it up from the AWS IAM console, the AWS SDK, or CloudFormation/CDK.

The story so far

Until now, there were really only two ways to grant workforce access to AWS accounts:

• Federate users into each AWS account separately and define permissions narrowly with IAM roles in each account
• Federate once through IAM Identity Center and manage access centrally using permission sets

The first approach gets harder to manage as your account count grows. The second means learning and operating a whole separate concept, permission sets. If you wanted both centralized management and the flexibility of IAM roles, neither option was quite right.

What changes

With account access manager, you keep IAM Identity Center's single federation point and user visibility, while still using the IAM roles that already exist in each account for permissions. There's no need to build out a new set of permission sets, you can reuse the per-account IAM roles you already have, which simplifies permission design across multi-account environments.

Dive Deep

Account access manager comes at no additional cost and is enabled by default in every AWS Commercial Region, so you can go open the IAM console and try it right now. For detailed steps, check the AWS Identity and Access Management User Guide.

Wrap-up

• New account access manager feature lets you assign IAM roles directly to workforce users and groups
• Previously it was either per-account federation or centralized management via permission sets, pick one
• Combines IAM Identity Center's single federation point with the flexibility of IAM roles
• No additional cost, enabled by default across all AWS Commercial Regions
• Configurable via the IAM console, SDK, or CloudFormation/CDK

If your team manages multiple AWS accounts through IAM Identity Center, this is an update that pays off starting today!