JA EN
shiichan

IAM Identity Center now lets you skip AWS account access management for new instances, avoiding service-linked role sprawl

AWS What's New ★★★ View Markdown
#aws#security#infrastructure

Hey, it's me! I found a small but genuinely useful update from AWS IAM Identity Center, so let me walk you through it.

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, when you create a new IAM Identity Center organization instance, you can now choose whether to enable management of AWS account access. This choice is only available at the time you first configure the instance, and it doesn't affect existing IAM Identity Center instances.

IAM Identity Center lets you connect your workforce identities to AWS once, then manage access to AWS applications across your organization from a single place. End users get single sign-on and a consistent authentication experience.

The story so far

Before this change, using IAM Identity Center meant AWS account access management came bundled in by default — there was no way around it. So even organizations that just wanted simple SSO for AWS applications ended up with AWS account access management enabled too, whether they needed it or not.

What changes

With this update, if you choose not to enable AWS account management, IAM Identity Center no longer provisions its service-linked role into your member accounts. That directly reduces the access surface across your environment.

In other words, if your organization only wants to manage access to AWS applications, you're no longer forced to spread account-level permissions you don't need. That's a nice win for security-conscious admins.

Dive Deep

Here are the concrete details worth knowing:

  • This option only appears when creating a new IAM Identity Center instance — existing instances aren't affected
  • When account management is disabled, the service-linked role is not deployed to member accounts
  • You're not locked in: you can enable account management permissions later through the instance settings, or via the UpdateInstance API
  • This capability is available in all AWS Regions where IAM Identity Center is available
  • For setup details, check the "Configure instance settings" page in the IAM Identity Center User Guide

Wrap-up

  • New IAM Identity Center organization instances can now skip enabling AWS account access management at creation time
  • Disabling it means no service-linked role gets deployed to member accounts, shrinking your access surface
  • Existing instances aren't affected, and you can flip the setting later via the UpdateInstance API
  • Available in all AWS Regions

If your team just wants clean SSO for AWS applications, or you're trying to keep permissions as minimal as possible, this quiet little update is worth knowing about.

Related posts