Set Up AWS IAM Identity Center (SSO) Step by Step
Enable Identity Center, create one user and a ReadOnly permission set, assign them to your account, sign in through the portal, then remove the lab assignment so you do not leave extra admin paths open.
What you'll learn in this chapter
- Enable Identity Center
- Create user and group
- Create a permission set
- Assign to an AWS account
- Portal login and cleanup
1. Lab: click by click
How to do it (step by step)
You need access to the management account of an AWS Organization (or a standalone account where Identity Center can be enabled). Region tip: pick one Identity Center home Region carefully — often ap-south-1 for Pune labs if your org allows it. Confirm with your trainer if the org already enabled another Region.
A. Enable
- Console search → IAM Identity Center.
- If prompted, Enable. Accept the Identity Center directory as identity source for this lab (simplest).
- Note the AWS access portal URL on the dashboard — bookmark it.
B. User and group
- Users → Add user: username
lab-student, email you control, name. Send invite or set password per console options. - Groups → Create group
lab-readers. Addlab-student. - Enable MFA on the user when the console offers it — do not skip.
C. Permission set
- Permission sets → Create.
- Use predefined ReadOnlyAccess for the lab (or a custom set with only
s3:ListAllMyBucketsif you want tighter). Name:lab-readonly. Session duration 1 hour. - Do not attach AdministratorAccess for a first lab user.
D. Assign and sign in
- AWS accounts → select your account → Assign users or groups → Group
lab-readers→ permission setlab-readonly. - Wait until status Succeeded.
- Open the access portal URL → sign in as
lab-student→ pick the account →lab-readonly. - Optional CLI: install AWS CLI v2 →
aws configure sso→aws sso login --profile lab→aws sts get-caller-identity --profile lab.
Cleanup
- Remove the account assignment for
lab-readers/lab-readonly. - Delete the permission set if unused. Delete or disable
lab-student. - Keep Identity Center enabled if the org uses it — do not disable shared org SSO without permission.
Ravindra Bagale's Tip
If Enable is greyed out, you are not in the management account or Identity Center already lives in another Region/account. Ask before creating a second org.
2. Interview angles
Q. Why ReadOnly first?
Least privilege while you learn the portal flow.
Q. Permission set vs IAM policy?
Set is Identity Center’s template; it materializes as a role+policies in the account.
Q. aws sso login purpose?
Fetches temporary creds into a named profile.
Q. Can I assign Admin to everyone?
No — break-glass only; daily ReadOnly/PowerUser.
Try at home
- Create a second permission set with PowerUserAccess and assign only to a group you are in.
- Next: how Active Directory fits as an identity source.
In short
- Enable Identity Center and save the portal URL.
- User/group + permission set + account assignment.
- Sign in via portal; CLI uses aws sso login.
- Remove lab assignments when finished.
Practice Tasks
Sydney Surf School is a sports training business in Sydney. Liam O'Brien looks after its IT and cloud work. They count money in AUD and run their AWS resources in the ap-southeast-2 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.
0 / 10
Easy Configure a named profile
Why: Profiles keep keys for different accounts apart.
What to do: Start the interactive setup for a profile named sydneysurf-prod.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy Check who you are logged in as
Why: Always confirm the account and identity before running changes.
What to do: Show the account ID and ARN of the identity your CLI is using.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy How many addresses in a /16?
Why: Picking a VPC size needs this count.
What to do: Sydney Surf School plans the VPC 10.153.0.0/16. How many IP addresses does it hold in total?
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Easy Port for SSH
Why: Security group rules need the right port.
What to do: Which TCP port must the security group open for SSH?
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Easy Show where you are
Why: Before you copy or delete anything, you must know which folder you are in.
What to do: Liam O'Brien logged in to the Sydney Surf School server and is not sure which folder the terminal is in. Print the current folder path.
- Find the Linux command that does this job.
- Add the options (like -r or -h) the task needs.
- Add the file names, folders or users in the right order.
- Use sudo if the job changes system files or users. Click Check answer.
Medium List Identity Center instances
Why: You need the instance ARN and identity store ID for SSO admin commands.
What to do: List the IAM Identity Center instances.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Log in with SSO
Why: SSO gives short-lived keys, so no long-term access keys sit on your laptop.
What to do: Log in with IAM Identity Center for profile sydneysurf-dev.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Set the default Region of a profile
Why: Setting region in the profile saves typing --region every time.
What to do: Set region to ap-southeast-2 for profile sydneysurf-prod using aws configure set.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Create access keys for a user
Why: Access keys let a user run the AWS CLI. Store them safely and rotate them.
What to do: Create an access key for user liam.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Create a permission set
Why: A permission set is a role template that Identity Center creates in each account.
What to do: Create permission set ReadOnly-sydneysurf in instance arn:aws:sso:::instance/ssoins-1234567890abcdef with session duration PT8H.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Revision, comparison and interview cards
Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.
More cards: Ravi Sir's Cards.