# Automating Multi-Account Permission Management with AWS IAM Identity Center (previously AWS SSO)

DevFeed: [Automating Multi-Account Permission Management with AWS IAM Identity Center (previously AWS SSO)](<https://devfeed.tech/articles/automating-multi-account-permission-management-with-aws-iam-identity-center-previously-aws-sso-23893.md>)

Original publisher: [Read original article](<https://medium.com/smg-real-estate/automating-multi-account-permission-management-with-aws-iam-identity-center-previously-aws-sso-b1d85281963?source=rss----2186e5b9bd8f---4>)

Author: Niko Jernejsek

Published: 2022-12-22T10:32:09Z

Content type: article

Language: en

Sources: [Homegate Engineering Blog - Medium](<https://devfeed.tech/sources/homegate-engineering-blog-medium.md>)

Topics: [AWS IAM Identity Center](<https://devfeed.tech/topics/aws-iam-identity-center.md>), [AWS Organizations](<https://devfeed.tech/topics/aws-organizations.md>), [Single sign-on (SSO)](<https://devfeed.tech/topics/sso.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [IAM](<https://devfeed.tech/topics/iam.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [aws-eventbridge](<https://devfeed.tech/tags/aws-eventbridge.md>), [aws-iam](<https://devfeed.tech/tags/aws-iam.md>), [aws-iam-identity-center](<https://devfeed.tech/tags/aws-iam-identity-center.md>), [aws-organizations](<https://devfeed.tech/tags/aws-organizations.md>), [cicd](<https://devfeed.tech/tags/cicd.md>), [cloudformation](<https://devfeed.tech/tags/cloudformation.md>), [iam-identity-center](<https://devfeed.tech/tags/iam-identity-center.md>), [least-privilege](<https://devfeed.tech/tags/least-privilege.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>)

## AI overview

This article describes Homegate's multi-account AWS strategy and its use of AWS IAM Identity Center, formerly AWS SSO, to centrally manage permissions for engineers across AWS accounts. It explains the use of permission matrices, least-privilege access, AWS Organizations, external identity providers through SAML 2.0, and SCIM.

## Source excerpt

Background Homegate was founded in 2001 and is now the leading property marketplace in Switzerland. Few years ago we decided to re-architect our monolithic real estate platform towards micro services on top of AWS cloud. At the moment, Homegate workloads are running almost exclusively on server-less compute model with teams organised around micro services. We are utilising so called multi-account strategy where we structure our AWS accounts around individual micro services further breaking them down into different accounts according to software lifecycle, and organising them into the AWS Organizational Units. We've structured our AWS Organizations Units & AWS accounts according to the recommendations provided by AWS (https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/basic-organization.html#basic-organization-with-cicd-as-a-separate-function). Apart from having product workload accounts we also have accounts which are necessary to operate security, governance and platform related workloads. Access to accounts is governed by a permission matrix which is based on least privilege principles. The permission matrix classifies who (internally defined personas, e.g.: engineers/managers/security officers, etc) has what type of access (e.g. read-only or admin), and to what category of AWS accounts (e.g. production workloads, shared infra accounts, etc). Group of accounts in our Permission Matrix are at the same time AWS Organisational Units that we implement. As we have to manage permissions for hundreds of engineers to about hundred of AWS accounts accordingly, this way of grouping makes it easier for us to manage it at scale. IAM Identity Center PrimerIAM Identity Center Intro Note that I will be using AWS IAM Identity Center and AWS SSO interchangeably as even some services (such as CloudFormation) are still using the previous name AWS SSO. AWS IAM Identity Center is a single sign-on (SSO) service that allows AWS users to centrally manage acces