AWS Identity Center

Nutzungsanweisungen

Provision and revoke temporary access to AWS accounts via IAM Identity Center (SSO). Assign permission sets to users or groups, look up users by email, and list accounts and permission sets for access request workflows.

Tools

`identity_center_list_instances`

List all AWS IAM Identity Center instances in your account

Eingabe

Parameter	Typ	Erforderlich	Beschreibung
`region`	string	Ja	AWS region (e.g., us-east-1)
`accessKeyId`	string	Ja	AWS access key ID
`secretAccessKey`	string	Ja	AWS secret access key
`maxResults`	number	Nein	Maximum number of instances to return (1-100)
`nextToken`	string	Nein	Pagination token from a previous request

Ausgabe

Parameter	Typ	Beschreibung
`instances`	json	List of Identity Center instances with instanceArn, identityStoreId, name, status, statusReason
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of instances returned

`identity_center_list_accounts`

List all AWS accounts in your organization

Eingabe

Parameter	Typ	Erforderlich	Beschreibung
`region`	string	Ja	AWS region (e.g., us-east-1)
`accessKeyId`	string	Ja	AWS access key ID
`secretAccessKey`	string	Ja	AWS secret access key
`maxResults`	number	Nein	Maximum number of accounts to return
`nextToken`	string	Nein	Pagination token from a previous request

Ausgabe

Parameter	Typ	Beschreibung
`accounts`	json	List of AWS accounts with id, arn, name, email, status
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of accounts returned

`identity_center_describe_account`

Retrieve details about a specific AWS account by its ID

Eingabe

Parameter	Typ	Erforderlich	Beschreibung
`region`	string	Ja	AWS region (e.g., us-east-1)
`accessKeyId`	string	Ja	AWS access key ID
`secretAccessKey`	string	Ja	AWS secret access key
`accountId`	string	Ja	AWS account ID to describe

Ausgabe

Parameter	Typ	Beschreibung
`id`	string	AWS account ID
`arn`	string	AWS account ARN
`name`	string	Account name
`email`	string	Root email address of the account
`status`	string	Account status (ACTIVE, SUSPENDED, etc.)
`joinedTimestamp`	string	Date the account joined the organization

`identity_center_list_permission_sets`

List all permission sets defined in an IAM Identity Center instance

Eingabe

Parameter	Typ	Erforderlich	Beschreibung
`region`	string	Ja	AWS region (e.g., us-east-1)
`accessKeyId`	string	Ja	AWS access key ID
`secretAccessKey`	string	Ja	AWS secret access key
`instanceArn`	string	Ja	ARN of the Identity Center instance
`maxResults`	number	Nein	Maximum number of permission sets to return
`nextToken`	string	Nein	Pagination token from a previous request

Ausgabe

Parameter	Typ	Beschreibung
`permissionSets`	json	List of permission sets with permissionSetArn, name, description, sessionDuration
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of permission sets returned

`identity_center_get_user`

Look up a user in the Identity Store by email address

Eingabe

Parameter	Typ	Erforderlich	Beschreibung
`region`	string	Ja	AWS region (e.g., us-east-1)
`accessKeyId`	string	Ja	AWS access key ID
`secretAccessKey`	string	Ja	AWS secret access key
`identityStoreId`	string	Ja	Identity Store ID (from the Identity Center instance)
`email`	string	Ja	Email address of the user to look up

Ausgabe

Parameter	Typ	Beschreibung
`userId`	string	Identity Store user ID (use as principalId)
`userName`	string	Username in the Identity Store
`displayName`	string	Display name of the user
`email`	string	Email address of the user

`identity_center_get_group`

Look up a group in the Identity Store by display name

Eingabe

Parameter	Typ	Erforderlich	Beschreibung
`region`	string	Ja	AWS region (e.g., us-east-1)
`accessKeyId`	string	Ja	AWS access key ID
`secretAccessKey`	string	Ja	AWS secret access key
`identityStoreId`	string	Ja	Identity Store ID (from the Identity Center instance)
`displayName`	string	Ja	Display name of the group to look up

Ausgabe

Parameter	Typ	Beschreibung
`groupId`	string	Identity Store group ID (use as principalId)
`displayName`	string	Display name of the group
`description`	string	Group description

`identity_center_list_groups`

List all groups in the Identity Store

Eingabe

Parameter	Typ	Erforderlich	Beschreibung
`region`	string	Ja	AWS region (e.g., us-east-1)
`accessKeyId`	string	Ja	AWS access key ID
`secretAccessKey`	string	Ja	AWS secret access key
`identityStoreId`	string	Ja	Identity Store ID (from the Identity Center instance)
`maxResults`	number	Nein	Maximum number of groups to return
`nextToken`	string	Nein	Pagination token from a previous request

Ausgabe

Parameter	Typ	Beschreibung
`groups`	json	List of groups with groupId, displayName, description
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of groups returned

`identity_center_create_account_assignment`

Grant a user or group access to an AWS account via a permission set (temporary elevated access)

Eingabe

Parameter	Typ	Erforderlich	Beschreibung
`region`	string	Ja	AWS region (e.g., us-east-1)
`accessKeyId`	string	Ja	AWS access key ID
`secretAccessKey`	string	Ja	AWS secret access key
`instanceArn`	string	Ja	ARN of the Identity Center instance
`accountId`	string	Ja	AWS account ID to grant access to
`permissionSetArn`	string	Ja	ARN of the permission set to assign
`principalType`	string	Ja	Type of principal: USER or GROUP
`principalId`	string	Ja	Identity Store ID of the user or group

Ausgabe

Parameter	Typ	Beschreibung
`message`	string	Status message
`status`	string	Provisioning status: IN_PROGRESS, FAILED, or SUCCEEDED
`requestId`	string	Request ID to use with Check Assignment Status
`accountId`	string	Target AWS account ID
`permissionSetArn`	string	Permission set ARN
`principalType`	string	Principal type (USER or GROUP)
`principalId`	string	Principal ID
`failureReason`	string	Reason for failure if status is FAILED
`createdDate`	string	Date the request was created

`identity_center_delete_account_assignment`

Revoke a user or group access to an AWS account by removing a permission set assignment

Eingabe

Parameter	Typ	Erforderlich	Beschreibung
`region`	string	Ja	AWS region (e.g., us-east-1)
`accessKeyId`	string	Ja	AWS access key ID
`secretAccessKey`	string	Ja	AWS secret access key
`instanceArn`	string	Ja	ARN of the Identity Center instance
`accountId`	string	Ja	AWS account ID to revoke access from
`permissionSetArn`	string	Ja	ARN of the permission set to remove
`principalType`	string	Ja	Type of principal: USER or GROUP
`principalId`	string	Ja	Identity Store ID of the user or group

Ausgabe

Parameter	Typ	Beschreibung
`message`	string	Status message
`status`	string	Deprovisioning status: IN_PROGRESS, FAILED, or SUCCEEDED
`requestId`	string	Request ID to use with Check Assignment Status
`accountId`	string	Target AWS account ID
`permissionSetArn`	string	Permission set ARN
`principalType`	string	Principal type (USER or GROUP)
`principalId`	string	Principal ID
`failureReason`	string	Reason for failure if status is FAILED
`createdDate`	string	Date the request was created

`identity_center_check_assignment_status`

Check the provisioning status of an account assignment creation request

Eingabe

Parameter	Typ	Erforderlich	Beschreibung
`region`	string	Ja	AWS region (e.g., us-east-1)
`accessKeyId`	string	Ja	AWS access key ID
`secretAccessKey`	string	Ja	AWS secret access key
`instanceArn`	string	Ja	ARN of the Identity Center instance
`requestId`	string	Ja	Request ID returned from Create or Delete Account Assignment

Ausgabe

Parameter	Typ	Beschreibung
`message`	string	Human-readable status message
`status`	string	Current status: IN_PROGRESS, FAILED, or SUCCEEDED
`requestId`	string	The request ID that was checked
`accountId`	string	Target AWS account ID
`permissionSetArn`	string	Permission set ARN
`principalType`	string	Principal type (USER or GROUP)
`principalId`	string	Principal ID
`failureReason`	string	Reason for failure if status is FAILED
`createdDate`	string	Date the request was created

`identity_center_check_assignment_deletion_status`

Check the deprovisioning status of an account assignment deletion request

Eingabe

Parameter	Typ	Erforderlich	Beschreibung
`region`	string	Ja	AWS region (e.g., us-east-1)
`accessKeyId`	string	Ja	AWS access key ID
`secretAccessKey`	string	Ja	AWS secret access key
`instanceArn`	string	Ja	ARN of the Identity Center instance
`requestId`	string	Ja	Request ID returned from Delete Account Assignment

Ausgabe

Parameter	Typ	Beschreibung
`message`	string	Human-readable status message
`status`	string	Current deletion status: IN_PROGRESS, FAILED, or SUCCEEDED
`requestId`	string	The deletion request ID that was checked
`accountId`	string	Target AWS account ID
`permissionSetArn`	string	Permission set ARN
`principalType`	string	Principal type (USER or GROUP)
`principalId`	string	Principal ID
`failureReason`	string	Reason for failure if status is FAILED
`createdDate`	string	Date the request was created

`identity_center_list_account_assignments`

List all account assignments for a specific user or group across all accounts

Eingabe

Parameter	Typ	Erforderlich	Beschreibung
`region`	string	Ja	AWS region (e.g., us-east-1)
`accessKeyId`	string	Ja	AWS access key ID
`secretAccessKey`	string	Ja	AWS secret access key
`instanceArn`	string	Ja	ARN of the Identity Center instance
`principalId`	string	Ja	Identity Store ID of the user or group
`principalType`	string	Ja	Type of principal: USER or GROUP
`maxResults`	number	Nein	Maximum number of assignments to return
`nextToken`	string	Nein	Pagination token from a previous request

Ausgabe

Parameter	Typ	Beschreibung
`assignments`	json	List of account assignments with accountId, permissionSetArn, principalType, principalId
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of assignments returned

AWS Identity Center

On this page