【With Step-by-Step Images】Setting Up Active Directory and IAM Identity Center Integration 1: Granting Access to Employees

Based on the Active Directory already used for employee management, grant access permissions to the AWS Management Console.
With IAM Identity Center, you can easily manage and assign access rights in bulk, making it much simpler than creating individual IAM users for each employee.
From integration setup to granting access permissions, this guide introduces the steps with images based on real-world experience.

This article is a continuation of the previous one, where Active Directory has already been set up.
For information on setting up Active Directory, please refer to the previous article.

Background

While working on building a remote work environment on AWS, I received requests from employees wanting to use AWS for their projects.
Although creating a separate AWS account for each project was considered, this approach could lead to a proliferation of AWS accounts.
To streamline billing under a single AWS account, I decided to stick to one AWS account and provide access to users accordingly.

Challenges

The first idea that came to mind was to issue IAM users for the employees.
However, this approach presented several management challenges:

There are many project members, and issuing IAM users for all of them would be difficult.
An IAM user cannot belong to multiple IAM groups.
(This becomes problematic when members are part of multiple projects.)
There is a risk of forgetting issued IAM users,
which could result in leftover accounts from employees who have left the company, making it difficult to track their purpose.

As a result, I started searching for a centralized management solution.
Since the remote work environment was already set up to manage user IDs through Active Directory,
I thought it would be ideal to manage user access via Active Directory users.

Method

By using IAM Identity Center, it became clear that centralized management of user access and permissions is possible.
Additionally, it was found that Active Directory can be specified as the source for managed users.
Therefore, I decided to integrate IAM Identity Center with the existing Active Directory to grant access rights to users.
The configuration is roughly as follows:

Administrator’s Procedure

Creating an Active Directory Group (Parent Group)

Even after setting up the integration, not all users in Active Directory are automatically registered in IAM Identity Center.
You need to specify which groups or users to synchronize with IAM Identity Center after the integration.
Therefore, create a parent group that encompasses the target users for synchronization in advance.†

Use the URL below to create a group.
Replace <Directory ID> with your own Directory ID as needed:
https://us-east-1.console.aws.amazon.com/directoryservicev2/home?region=us-east-1&tab=groups#!/directories/<Directory ID>/createGroup

[Step 1] Specify Group Details
- Group name: IAMIdentityCenterAllUsersAndGroups
- Group type: ⦿ Security
- Group scope: ⦿ Domain local