AWS IAM & Access
SSO, Least-Privilege, and SaaS Auth Without Audit Findings.
What this hub covers
IAM is where most AWS environments quietly break least-privilege. The guides below cover production-grade IAM patterns, IAM Identity Center for workforce SSO and identity propagation into Q Business / Redshift / QuickSight / S3 Access Grants, fine-grained authorization with Verified Permissions and Cedar 4.7 (with native API Gateway authorizers and AppSync BatchIsAuthorized for graphs), and SaaS-grade customer auth with Cognito on its tiered Lite / Essentials / Plus pricing — covering federation, MFA, and tenant isolation.
4 guides in this hub
Each one is written for a production AWS estate: the configuration, the trade-offs and what the auditor asks for. Part of the AWS Security & Compliance hub.
AWS IAM Best Practices: Least Privilege Access Control
Least privilege is easy to say and harder to run at production scale. This covers roles vs users, permission boundaries, SCPs, identity federation, and the access-control patterns that keep teams fast without leaving keys lying around.
Read the guideAmazon Verified Permissions: Fine-Grained Authorization with Cedar for SaaS Applications
Amazon Verified Permissions externalizes application authorization logic using the Cedar policy language. Here's how to replace home-grown RBAC with a centralized, auditable policy store on AWS.
Read the guideAWS Cognito Authentication for SaaS Applications
July 2026: Cognito user pools for SaaS, covering managed login vs classic hosted UI, pool vs silo tenancy, federation limits, and a checklist before you outgrow Cognito into Auth0/Okta.
Read the guideAWS IAM Identity Center: Workforce SSO and Identity Propagation in Production
AWS IAM Identity Center is the AWS-native workforce SSO and identity-propagation service. This guide covers federation from Okta / Microsoft Entra ID, permission-set design, attribute-based access control (ABAC), identity propagation to Q Business / Redshift / QuickSight / S3 Access Grants, and the migration off long-lived IAM users.
Read the guideServices and neighbouring hubs
The engagements that apply these guides, in navy, and the hubs buyers usually read alongside this one.
AWS Security Consulting
AWS security consulting from an AWS Select Tier Partner. 2-week assessment, 4–6 week remediation, zero disruption. IAM hardening, public exposure, compliance gaps, and continuous monitoring.
Explore the serviceGovernance & Multi-Account
Multi-account is where compliance scope is either won or quietly lost. Control Tower, landing-zone topology, automated conformance packs, and drift detection — the patterns that hold scope at 50+ accounts.
Open the hubThreat Detection & Response
Continuous monitoring, Security Hub AI inventory, agentless vulnerability scanning, OCSF data lakes, and automated remediation.
Open the hubCompliance Frameworks
Framework-by-framework guidance — what auditors expect, what AWS provides, and what your team configures.
Open the hubCommon questions
- When do we need IAM Identity Center vs Amazon Cognito?
- They solve different problems. IAM Identity Center is the AWS-native workforce identity service: it federates your employees (from Okta, Microsoft Entra ID, Google Workspace, or its own directory) into AWS accounts, applications, and identity-aware services like Q Business, Redshift, QuickSight, and S3 Access Grants — propagating the human identity end-to-end so audit logs show who, not which IAM role. Cognito is a customer-facing user pool for your SaaS application end users — sign-up, sign-in, MFA, social/SAML federation, and JWT issuance. Most platforms run both: Identity Center for staff and admins, Cognito for tenants. They are not interchangeable, and AWS has not merged User Pools and Identity Pools as some 2023 commentary suggested.
- How do we federate AWS Console + CLI access from Okta or Entra ID?
- Connect your IdP to IAM Identity Center via SAML 2.0 or SCIM (for automatic group/user provisioning). Define permission sets (managed-policy collections plus inline policies and a session duration up to 12 hours) and assign them to AWS accounts via groups. Users get the AWS access portal — a single landing page that issues short-lived credentials for the console and the AWS CLI v2 (`aws configure sso`). Avoid the legacy pattern of long-lived IAM users; the IAM Access Analyzer external-access findings will surface them and most auditors will flag them too. ABAC works on top of permission sets when you tag both the principal (via SCIM attribute mapping) and the resource.
- Does ABAC actually work in production, or is RBAC simpler?
- ABAC works at scale once tag governance is enforced. The pattern: enforce mandatory tags on every resource via Service Control Policies (e.g. `aws:ResourceTag/CostCenter` and `aws:ResourceTag/Environment` required on creation) and on every principal via permission-set session tags. Then write a small number of permission sets that read those tags (`Condition: StringEquals: aws:ResourceTag/Environment: ${aws:PrincipalTag/Environment}`). New teams or environments do not need new policies — they need a tag. The first 90 days are tag-cleanup hell; after that, ABAC scales further than RBAC and audits cleaner because the policy text does not enumerate every team.
Apply this to your environment
Our consulting engagements apply this guidance to your specific environment, regulatory scope and threat model.
Pictures:Lock and Key (public domain (CC0)); Lock and Key (public domain (CC0)); Coffer lock and key (public domain (CC0)); Padlock and key, André Omereler (public domain (CC0)); Padlock, French (?) maker (public domain (CC0)); Chubb lock (public domain); Safe deposit vault 1908, The Cleveland Trust Company (public domain); The Street Locksmith (6899206616), John Thomson (no known copyright restrictions).Via The Metropolitan Museum of Art and Wikimedia Commons.
.jpg){kind=link}