IAM Identity Center now lets your own apps reach AWS accounts programmatically!

Hey there, it's me, Shiichan! Today I found a quiet but genuinely handy update in the AWS identity world, so let me share it with you.

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, IAM Identity Center now lets your own customer managed applications access AWS accounts programmatically. An app can discover the accounts and roles assigned to a user on their behalf, and retrieve temporary credentials.

The story so far

Until now, IAM Identity Center was mostly about people picking an account from the portal and signing in by hand. Wiring up your own app to automatically walk through "which accounts and which roles can this user use" and grab credentials from there wasn't something you could do cleanly.

What changes

From now on, your own app can discover the usable accounts and roles for a user and fetch temporary credentials right there. And if you trust an external identity provider as a trusted token issuer (TTI), you can spare users from logging in again and again.

Dive Deep

There are a few conditions worth knowing up front.

• It works only with organization instances.
• The management account or a delegated administrator has to enable it explicitly.
• Supported Regions include all commercial AWS Regions, plus GovCloud (US) and the China Regions.

The setup steps are laid out in the AWS Enable AWS account access for customer managed applications guide.

Wrap-up

• IAM Identity Center now lets your own apps access AWS accounts programmatically.
• Apps can discover accounts and roles and retrieve temporary credentials on a user's behalf.
• With a TTI, you can cut down on redundant re-logins.
• It's limited to organization instances and needs admin enablement, and it's available in commercial, GovCloud (US), and China Regions.

This one lands for developers and platform teams who want to connect internal tools or SaaS to IAM Identity Center!