Use AWS IAM Identity Center to assign or revoke permission sets for AWS accounts, resolve users and groups, and inspect account access.
The same operations support the reverse direction — access review. Starting from an account, an agent can list its assignments, resolve the principals, expand groups into their members, and produce a written report of exactly who can reach that account and through which permission set.
AWS requires a permission set ARN alongside the account ID on this call, so List Assignments For Account returns only the assignments granted through that one permission set — not every assignment on the account. To cover an account completely, run List Permission Sets for the instance first, then call List Assignments For Account once per permission set and combine the results. Skipping that loop silently omits access granted through the permission sets you did not ask about.
Creating and deleting an account assignment are asynchronous: both return a request ID, and each has its own status poller — use Check Assignment Status for creations and Check Assignment Deletion Status for deletions, as the two request-ID types are not interchangeable. And the account-listing operations call AWS Organizations, which is global per partition; the block resolves the correct endpoint for commercial, GovCloud, and China regions automatically.
Use the block
Assign and revoke access to AWS accounts via IAM Identity Center (SSO). Assign permission sets to users or groups, look up users by email, and list accounts and permission sets for access request workflows.
Actions
Identity Center List Instances
List all AWS IAM Identity Center instances in your account
Identity Center List Accounts
List all AWS accounts in your organization
Identity Center Describe Account
Retrieve details about a specific AWS account by its ID
Identity Center List Permission Sets
List all permission sets defined in an IAM Identity Center instance
Identity Center Get User
Look up a user in the Identity Store by email address
Identity Center Describe User
Resolve an Identity Store user ID to the user behind it. Use to turn the principalId on an account assignment into a name and email.
Identity Center Get Group
Look up a group in the Identity Store by display name
Identity Center Describe Group
Resolve an Identity Store group ID to the group behind it. Use to turn the principalId on an account assignment into a group name.
Identity Center List Groups
List all groups in the Identity Store
Identity Center List Group Memberships
List the users who belong to an Identity Store group
Identity Center Create Account Assignment
Grant a user or group access to an AWS account via a permission set (temporary elevated access)
Identity Center Delete Account Assignment
Revoke a user or group access to an AWS account by removing a permission set assignment
Identity Center Check Assignment Status
Check the provisioning status of an account assignment creation request
Identity Center Check Assignment Deletion Status
Check the deprovisioning status of an account assignment deletion request
Identity Center List Account Assignments For Principal
List every account and permission set a specific user or group is assigned. Use List Assignments For Account to go the other way, from an account to its principals.
Identity Center List Assignments For Account
List every principal assigned a specific permission set on a specific AWS account. Use for per-account access reviews.