# Practical Example of AWS Identity Center (SSO) Setup

## **Introduction**

AWS **Identity Center** (formerly AWS SSO) allows users to **securely access multiple AWS accounts and integrated applications** using a **single sign-on (SSO) portal**. To use **Identity Center**, an **AWS Organization** must be configured.

With AWS **SSO**, users can log in once and access multiple accounts or applications without needing separate credentials.

## **Choosing an Identity Provider**

When setting up AWS **Identity Center**, you need to select an **identity provider (IdP)**. AWS offers **two options**:

1. **Built-in AWS Identity Store** (default).
    
2. **External Identity Provider (IdP)** (e.g., **Active Directory, Okta, or Azure AD**).
    

In this example, we will use the **AWS-provided Identity Store**.

## **Step-by-Step Setup**

### **Step 1: Create a User and Assign to a Group**

1. Navigate to **AWS IAM Identity Center** in the AWS Management Console.
    
2. Click **"Users"**, then **"Create User"**.
    
    * Enter **username, email, and password**.
        
3. Click **"Groups"**, then **"Create Group"**.
    
4. Add the user to the newly created group.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742965108142/389f0c49-11a7-47dd-aef4-bd8062a68358.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742965316680/cc0535fb-45da-4cd5-a904-13e60b736659.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742965434369/7731fdc6-92f1-468e-93ea-f837cde74856.png align="center")

### **Step 2: Create and Assign Permission Sets**

1. Go to **Permission Sets** in the Identity Center console.
    
2. Click **"Create Permission Set"** and choose:
    
    * **Predefined AWS policies** (e.g., Administrator, ReadOnly).
        
    * **Custom permissions** (based on IAM policies).
        
3. Assign the **permission set** to the **group** or **specific AWS accounts**.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742965651679/28dfaf66-d81b-4616-b76d-a610ab8c7688.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742965712848/325e7694-fb40-4843-91e7-3a17aefe2750.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742965890052/05427c5d-6782-4b4e-b17b-0fde513e77e8.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742965967707/3e58c88c-584e-42ef-92e3-649d86737103.png align="center")

### **Step 3: Access AWS Accounts via SSO**

1. Open the **AWS IAM Identity Center SSO Portal** (provided in the setup).
    
2. Log in with the created **user credentials**.
    
3. Upon login, the user will see **all assigned AWS accounts** and their respective **permissions**.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742978185259/1a5ad69b-91c0-4b69-92e0-62fae0d66358.png align="center")

Login to account that have Billing Permission set assigned. This user is not able to see anything in the Ec2 dashboard

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742968019162/43592657-bbce-4f2c-9556-aa47a3b5bfad.png align="left")

Login to the account which have ViewOnlyAccess. See it can see the EC2 dashboard portal

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742978520828/ec82a6db-fcdb-4931-adda-61dbffb8484d.png align="center")

## **Conclusion**

With AWS Identity Center, users can securely access multiple AWS accounts and applications through a **single SSO portal**. This improves security, reduces the need for multiple passwords, and simplifies access management.

---

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742977336401/3f05995a-1667-4d09-b609-5617ccbc9378.png align="center")