● Covered by 1 source · 1 reportMedium impact1 neutral
AWS Introduces Account Access Manager for Centralized IAM Role Management
Key points
- AWS IAM introduces Account Access Manager.
- Centralizes workforce access using existing IAM roles.
- Integrates with AWS IAM Identity Center for single federation.
- Supports attribute-based access control (ABAC) with role tags.
New Centralized Access Management
AWS Identity and Access Management (IAM) has released Account Access Manager, a new feature designed to simplify workforce access management for AWS accounts. This new offering aims to provide a more flexible approach to managing access by integrating existing IAM roles with the centralized federation capabilities of AWS IAM Identity Center.
Account Access Manager allows organizations to assign their existing IAM roles from individual AWS accounts to workforce users and groups managed within an IAM Identity Center instance. This creates a single point of control for access management, reducing the need to configure identity providers and manage role assignments independently across multiple accounts.
Addressing Workforce Access Challenges
Previously, enterprises using AWS faced a choice between the flexibility of IAM roles and the centralized control offered by IAM Identity Center. Managing IAM roles across individual accounts provided granular control but lacked a unified view and made multi-account assignments difficult. Conversely, IAM Identity Center offered a single federation point but its permission sets could be restrictive for teams with varied role requirements across accounts.
Account Access Manager addresses these trade-offs by enabling the use of existing, tailored IAM roles within the centralized framework of IAM Identity Center. This allows organizations to maintain the customization of their roles while benefiting from a single federation point and simplified identity propagation.
Key Capabilities and Benefits
The new service utilizes existing IAM roles, preserving their tailoring capabilities. This includes support for Attribute-Based Access Control (ABAC) through IAM role tags and session tags populated from identity providers as SAML claims. By leveraging existing infrastructure, Account Access Manager aims to provide a clear path to scalable and centralized access management without duplicating identities or managing per-account federation points.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub hashicorp/terraform-provider-aws GitHub aws-samples/sample-aam-migration-tool GitHub aws-samples/multiple-iam-identity-center-instance-managementReporting from
AWS has launched Account Access Manager, a new feature within AWS Identity and Access Management (IAM) that centralizes workforce access to AWS accounts. This tool combines the flexibility of existing IAM roles with the centralized federation capabilities of AWS IAM Identity Center, allowing users to assign existing IAM roles to workforce users and groups from a single point.