Give teammates the access their job needs — IAM Identity Center

Your goal

Plan consistent workforce access across several AWS accounts.

Why this matters

Your team is growing and copying permanent user keys is becoming risky. You will group people by role, assign limited access, and plan what happens when someone leaves.

Words you will use

A workforce identity belongs to a teammate. A permission set describes access for an account role. A group collects people who need similar access.

How to proceed

Read each situation and choose an answer. The lesson explains the result. Try again if needed, then continue through all three decisions and finish the tour.

1. Choose the right identity job

Employees need to enter several AWS accounts using the company’s identity system. This is a workforce task rather than a customer website login. Choose the fitting service.

What should you evaluate?

IAM Identity Center connected to the workforce identity source.

IAM Identity Center helps manage workforce access to AWS accounts and applications. Choose an identity source and onboarding process suited to the organization. Customer-facing app sign-in is a different design problem.

The access plan starts with workforce identities.

Workforce identity source → Identity Center

2. Assign useful limits

Developers need to inspect a production app but should not freely delete its resources. Choose a sensible assignment.

How should their access be modeled?

A group with a suitable permission set assigned to the needed account.

Use groups and permission sets to express job needs clearly. Assign access to the appropriate accounts and review the effective permissions. A convenient central sign-in should still follow least privilege.

Developers receive the access their work requires.

Developer group → limited permission set → production account

3. Plan the full lifecycle

A teammate changes roles and later leaves the company. The access design should cover both events rather than only the first login. Choose the maintenance task.

What needs regular review?

Membership, assignments, active access, and offboarding behavior.

Keep group membership and account assignments aligned with current responsibilities. Understand session lifetime and revocation behavior during offboarding. Removing an old assignment and checking active access are part of the same job.

Access follows the person’s current role and departure.

Role change or departure → review and remove access

Practice, then check your understanding

In the interactive tour, make each decision before seeing the outcome. Wrong answers receive coaching, and replay gives you a fresh attempt without duplicating earned XP.

Read the official AWS documentation for service behavior and production details.