Quick Wins Identity and access management

c1.6 Centralize identity and federate access

Give people temporary, centrally-managed access instead of long-lived IAM users and access keys. Connect your identity provider to AWS IAM Identity Center so access is granted and revoked from one place.

Implementation guidance

Use a central identity source, not IAM users

Long-lived IAM users and their access keys are durable secrets that get leaked, shared, and forgotten. Instead, federate access through AWS IAM Identity Center, which brokers temporary credentials to your people and applications. Connect your existing identity provider — Microsoft Entra ID, Okta, Ping, OneLogin, Google Workspace, or AWS Directory Service — as the identity source.

If you are just starting and have no directory yet, use IAM Identity Center's built-in identity store — you still get temporary credentials and centralized management from day one.

Deprovisioning is the point

The security value is in the join/leave lifecycle: integrate the identity source with your HR/joiner-mover-leaver process (directly or via an identity-management/SCIM system) so that when someone leaves, their AWS access is removed everywhere at once. Long-lived access keys do not have this property — they keep working until someone remembers to delete them.

Find the long-lived keys to replace

Generate an account credential report and list every IAM user that still has an active access key — these are the candidates to migrate to federated, temporary access:

aws iam generate-credential-report
aws iam get-credential-report \
  --query 'Content' --output text | base64 -d \
  | awk -F, 'NR==1 || $9=="true" || $14=="true"'

How it fits together

Your identity provider connects to AWS IAM Identity Center, which brokers temporary credentials to people across every account. Because access follows the joiner-mover-leaver lifecycle from the source, removing someone revokes their AWS access everywhere at once — with no long-lived keys left behind.

How to validate

Where do you authenticate employees, and is it connected to IAM Identity Center?
Are IAM users still provisioned for human access? How often are their access keys rotated?
When someone leaves, is their access removed automatically — and how long does it take from the HR event to actual revocation?

Threats addressed

ATT&CK Credential Access a former employee (or anyone holding durable credentials such as access keys) can retain access after leaving. With a central directory and federation, revoking the identity removes their AWS access immediately.

AWS services

AWS IAM Identity Center

AWS IAM

AWS Directory Service

Pricing

No additional charge

AWS IAM Identity Center is offered at no additional charge.

Framework mappings