AWS Identity Center

AWS IAM Identity Center (formerly AWS Single Sign-On) is the recommended service for managing workforce access to multiple AWS accounts and applications. It provides a central place to assign users and groups temporary, permission-scoped access to AWS accounts using permission sets — without creating long-lived IAM credentials.

With AWS IAM Identity Center, you can:

• Provision account assignments: Grant a user or group access to a specific AWS account with a specific permission set — the core primitive of temporary elevated access
• Revoke access on demand: Delete account assignments to immediately remove elevated permissions when they are no longer needed
• Look up users by email: Resolve a federated identity (email address) to an Identity Store user ID for programmatic access provisioning
• List permission sets: Enumerate the available permission sets (e.g., ReadOnly, PowerUser, AdministratorAccess) defined in your Identity Center instance
• Monitor assignment status: Poll the provisioning status of create/delete operations, which are asynchronous in AWS
• List accounts in your organization: Enumerate all AWS accounts in your AWS Organizations structure to populate access request dropdowns
• Manage groups: List groups and resolve group IDs by display name for group-based access grants

In Sim, the AWS Identity Center integration is designed to power TEAM (Temporary Elevated Access Management) workflows — automated pipelines where users request elevated access, approvers approve or deny it, access is provisioned with a time limit, and auto-revocation removes it when the window expires. This replaces manual console-based access management with auditable, agent-driven workflows that integrate with Slack, email, ticketing systems, and CloudTrail for full traceability.

Usage Instructions

Provision and revoke temporary access to AWS accounts via IAM Identity Center (SSO). Assign permission sets to users or groups, look up users by email, and list accounts and permission sets for access request workflows.

Tools

identity_center_list_instances

List all AWS IAM Identity Center instances in your account

Input

Output

identity_center_list_accounts

List all AWS accounts in your organization

Input

Output

identity_center_describe_account

Retrieve details about a specific AWS account by its ID

Input

Output

identity_center_list_permission_sets

List all permission sets defined in an IAM Identity Center instance

Input

Output

identity_center_get_user

Look up a user in the Identity Store by email address

Input

Output

identity_center_get_group

Look up a group in the Identity Store by display name

Input

Output

identity_center_list_groups

List all groups in the Identity Store

Input

Output

identity_center_create_account_assignment

Grant a user or group access to an AWS account via a permission set (temporary elevated access)

Input

Output

identity_center_delete_account_assignment

Revoke a user or group access to an AWS account by removing a permission set assignment

Input

Output

identity_center_check_assignment_status

Check the provisioning status of an account assignment creation request

Input

Output

identity_center_check_assignment_deletion_status

Check the deprovisioning status of an account assignment deletion request

Input

Output

identity_center_list_account_assignments

List all account assignments for a specific user or group across all accounts

Input

Output