AWS IAM Identity Center: Why Are We Still Managing So Many IAM Users?
This article explores how IAM Identity Center and OIDC can simplify AWS access, reduce credential management overhead, and make multi-account environments easier to manage.
I've worked with several AWS environments where accessing multiple accounts was more complicated than it needed to be.
In one setup, users had an account where they logged in first, then assumed roles to access other AWS accounts.
Fair enough. Cross-account roles are useful.
But I've also seen environments where every AWS account had its own IAM users.
Five AWS accounts? Potentially five users.
Then there were the passwords.
In one case, the same password was being used across accounts because remembering multiple passwords was a headache.
MFA wasn't enabled.
Password rotation wasn't enabled.
There was no password manager.
And CI/CD pipelines were using IAM user access keys.
This is the part that surprised me.
AWS already has IAM Identity Center.
With it, users can sign in once and access the AWS accounts and roles they've been given access to.
No separate IAM user in every account.
Add MFA, use permission sets, and access becomes much easier to manage.
For CI/CD, there is another option that I see teams missing quite often: OIDC.
Instead of keeping long-lived AWS access keys in a pipeline, the pipeline can authenticate using OIDC and receive temporary AWS credentials.
Much cleaner.
So why don't teams use these?
Sometimes they simply don't know about them.
Sometimes they do know, but the existing setup works, so nobody wants to touch it.
And I get it.
Changing authentication in a production environment is not exactly something you do for fun on a Friday afternoon.
But eventually, someone asks:
Who has access to this AWS account?
Or:
Does this person still have access?
Or:
Where is this access key being used?
That's when the old setup starts becoming painful.
IAM Identity Center isn't a magic solution for every AWS environment. But if you're managing multiple AWS accounts and still creating IAM users for people in each account, it's definitely worth looking at.
The same goes for long-lived credentials in CI/CD.
There are better options now.
Sometimes the hardest part isn't finding the technology.
It's convincing ourselves that the old way needs to change.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article