AWS Launches Account Access Manager to Enhance IAM Role Flexibility with Centralized Workforce Access

Amazon Web Services (AWS) has introduced Account Access Manager, an innovative feature designed to enhance workforce access management across AWS accounts. This service integrates the flexibility of traditional IAM roles with the centralized federation capabilities of AWS IAM Identity Center, offering organizations a streamlined and scalable way to handle permissions.

Previously, enterprises faced a trade-off when managing workforce access: configuring IAM roles separately for each account provided flexibility but was cumbersome, while IAM Identity Center permission sets offered centralized control but limited role customization. Account Access Manager removes this compromise by allowing existing IAM roles to be assigned centrally to users and groups synced through IAM Identity Center without duplicating identities.

Account Access Manager preserves key IAM role capabilities, such as attribute-based access control (ABAC) via session tags, trust policies with network or identity provider conditions, and the organizational benefits of role paths. Access sessions carry trusted identity propagation, meaning that every action is attributable to an individual user even when multiple users share a role, improving auditability and accountability.

Administrators create entitlements that assign specific IAM roles from individual accounts to users or groups through the Account Access Manager portal or programmatically via AWS CLI, SDKs, or infrastructure-as-code tools like CloudFormation and Terraform. This approach scales with the number of accounts instead of Identity Center quotas and reduces administrative overhead by grouping assignments.

The service supports sign-in through a dedicated portal URL or the existing AWS access portal, with compatibility for identity providers such as Okta, Microsoft Entra ID, and Ping Identity. Users can also access roles via the AWS CLI using the 'aws login' command, with session durations governed by each role's settings.

To implement the solution, organizations must enable Account Access Manager within their IAM Identity Center instance, modify IAM role trust policies to permit the manager’s service principal, and update firewalls to allow necessary endpoint access. AWS provides detailed setup guidance, including automation scripts to streamline trust policy updates.

While Account Access Manager enhances centralized management and user-level visibility, it requires administrators to maintain precise trust policies and ensure proper integration with identity providers. Also, existing roles must be compatible with the new trust policy requirements, and organizations need to prepare to manage assignments effectively at scale.

By combining IAM roles’ granular flexibility with the centralization benefits of IAM Identity Center, AWS Account Access Manager addresses the complexity of workforce access at scale. Its launch partners, including major identity and access governance providers, facilitate seamless adoption and integration into existing identity ecosystems.