What Is AWS IAM Identity Center (SSO) Explained
IAM Identity Center is the modern front door for humans. One login, many AWS accounts, temporary roles under the hood. Old-style IAM users with permanent keys are the backup plan — not the default.
What you'll learn in this chapter
- Identity Center vs old IAM users
- Permission sets = reusable role templates
- AWS access portal URL
- Users, groups, account assignments
- When Identity Center is the right default
1. Everyday example first
Why do we need this?
Flipkart staff do not carry a separate metal key for every warehouse. They badge in once; the system opens the doors their job needs. Identity Center is that badge for AWS accounts.
The warehouse story is made up for learning.
What is it?
AWS IAM Identity Center (the successor name for what many still call AWS SSO) gives workforce users a single sign-on portal into one or many AWS accounts. Behind each “tile” is a permission set that becomes an IAM role with temporary credentials.
| Old habit | Identity Center habit |
|---|---|
| Create IAM user per person per account | One Identity Center user; assign accounts + permission sets |
| Long-lived access keys for CLI | aws sso login → temporary keys |
| Copy AdministratorAccess to every user | Permission sets: ReadOnly, PowerUser, Admin break-glass |
2. Core words
- AWS access portal — the HTTPS URL users bookmark to pick account + role.
- Permission set — template of policies; Identity Center creates/updates a role per account assignment.
- Identity source — Identity Center directory, Active Directory, or external IdP (Okta, Entra ID, etc.).
- Account assignment — user/group + permission set + AWS account.
3. Identity Center vs IAM users
Why do we need this?
Interviewers ask which you prefer for a 50-person company with 5 AWS accounts.
What is it?
- Prefer Identity Center for humans: one place to hire/fire, MFA, and short sessions.
- Keep IAM users rare: break-glass, legacy automation not yet on roles, or tiny sandbox with one learner (still MFA).
- Workloads (EC2, Lambda) still use IAM roles — not Identity Center users.
Ravindra Bagale's Tip
Calling it “AWS SSO” in conversation is fine — people still search that name. On the console, look for IAM Identity Center.
4. Interview angles
Q. SSO vs IAM user?
SSO/Identity Center: one login, temp roles; IAM user: long-lived per account.
Q. Permission set?
Reusable policy pack that becomes a role in each assigned account.
Q. Where do CLI creds come from?
aws sso login caches temporary creds via STS.
Q. Workloads on Identity Center?
No — attach IAM roles to compute.
Q. Old name?
AWS Single Sign-On (AWS SSO).
Try at home
- Find the Identity Center console in your lab account (may need org/management account).
- Next: enable it and create a permission set step by step.
In short
- Identity Center = SSO portal for humans.
- Permission sets become temporary roles.
- Prefer it over fleets of IAM users.
- Compute still uses IAM roles.
Practice Tasks
Sahyadri Clinic is a healthcare business in Satara. Dr. Anil Deshmukh looks after its IT and cloud work. They count money in INR and run their AWS resources in the ap-south-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.
0 / 10
Easy Configure a named profile
Why: Profiles keep keys for different accounts apart.
What to do: Start the interactive setup for a profile named sahyadriclinic-prod.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy Check who you are logged in as
Why: Always confirm the account and identity before running changes.
What to do: Show the account ID and ARN of the identity your CLI is using.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy How many addresses in a /16?
Why: Picking a VPC size needs this count.
What to do: Sahyadri Clinic plans the VPC 10.94.0.0/16. How many IP addresses does it hold in total?
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Easy Port for SSH
Why: Security group rules need the right port.
What to do: Which TCP port must the security group open for SSH?
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Easy Show where you are
Why: Before you copy or delete anything, you must know which folder you are in.
What to do: Dr. Anil Deshmukh logged in to the Sahyadri Clinic server and is not sure which folder the terminal is in. Print the current folder path.
- Find the Linux command that does this job.
- Add the options (like -r or -h) the task needs.
- Add the file names, folders or users in the right order.
- Use sudo if the job changes system files or users. Click Check answer.
Medium List Identity Center instances
Why: You need the instance ARN and identity store ID for SSO admin commands.
What to do: List the IAM Identity Center instances.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Log in with SSO
Why: SSO gives short-lived keys, so no long-term access keys sit on your laptop.
What to do: Log in with IAM Identity Center for profile sahyadriclinic-dev.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Set the default Region of a profile
Why: Setting region in the profile saves typing --region every time.
What to do: Set region to ap-south-1 for profile sahyadriclinic-prod using aws configure set.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Create access keys for a user
Why: Access keys let a user run the AWS CLI. Store them safely and rotate them.
What to do: Create an access key for user anil.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Create a permission set
Why: A permission set is a role template that Identity Center creates in each account.
What to do: Create permission set ReadOnly-sahyadriclinic in instance arn:aws:sso:::instance/ssoins-1234567890abcdef with session duration PT8H.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Revision, comparison and interview cards
Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.
More cards: Ravi Sir's Cards.