AWS IAM Identity Center

IAM Identity Center is the recommended way to give people access to AWS. Users and groups come from its own directory or from an external identity provider (Microsoft Entra ID, Okta, Google). Permission sets define the access and are assigned to users or groups in one or more accounts of an organization. Users sign in to a portal and receive temporary credentials, so there are no long-lived IAM users or access keys.

With Terraform: aws_ssoadmin_permission_set, aws_ssoadmin_account_assignment and the aws_identitystore_* data sources. See multi-account setup.