AWS IAM Identity Center

​

Integration Specifications

​

Prerequisites

​

Step 1: Creating a Policy for Integration

1. Go to Identity and Access Management (IAM), and click [Create policy] from Policies in the left menu. For details, refer to Creating IAM policies (external site).
2. On the Create policy screen, click the JSON tab and overwrite with the following script.
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": [
                   "identitystore:ListGroupMemberships",
                   "sso:ListAccountAssignmentsForPrincipal",
                   "organizations:ListAccounts",
                   "sso:ListPermissionSets",
                   "identitystore:ListUsers",
                   "sso:ListInstances",
                   "identitystore:ListGroups",
                   "sso:DescribePermissionSet"
               ],
               "Resource": "*"
           }
       ]
   }
   
3. Enter a name of your choice and click [Create policy] to save. (No other fields are required.)

​

Step 2: Creating a Role for Integration

1. Go to Identity and Access Management (IAM), and click Roles > Create role from the left menu.
2. On the Select trusted entity screen, enter the following values. When finished, click [Next].
   • Trusted entity type: Select AWS account
   • AWS account: Select Another AWS account and enter 162001151631 as the account ID.
   • Check Require an external ID (Best practice when a third party will assume this role)
   • For External ID, enter a random alphanumeric string (no symbols, 24+ characters recommended).
   • Uncheck Require MFA.
   • To add or remove users, grant these permissions to the role.
   
3. Select the policy created in Step 1, then click Next.
4. Set any role name and click [Create role]. (No other fields need to be edited.)

​

Setting Permissions to Create and Delete Customer-Managed Policies

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "identitystore:CreateUser", 
                "identitystore:DeleteUser", 
                "identitystore:CreateGroupMembership" 
            ],
            "Resource": "*"
        }
    ]
}

​

Step 3: Confirming the Role ARN

1. Search for and open the role you created on the Roles screen.
2. The Role ARN will be displayed. Copy and save it.

​

Step 4: Confirming the Region and Workspace Key

​

Integration Setup

1. Go to Integrations > Integrations and search for AWS IAM Identity Center.
2. Enter the workspace key, region, Role ARN, and external ID obtained in the previous steps. These are the values set during role creation. Then click Connect.
3. Once the AWS IAM Identity Center integration succeeds, registered user information will appear in the account list.

​

Manual Account Matching for SaaS Services Where Email Address Cannot Be Retrieved