AWS Identity Center: Replace IAM Users with Federated Access

Day 25: AWS Identity Center and Federated Access

Static IAM credentials are the number one cause of AWS breaches I've seen in practice. Identity Center fixes this by federating authentication through your existing IdP.

Here's a quick Python script to audit your accounts for IAM users that should be migrated to SSO:

import boto3

def audit_iam_users(account_ids, role_name='OrganizationAuditor'):
    sts = boto3.client('sts')
    findings = []

    for account_id in account_ids:
        creds = sts.assume_role(
            RoleArn=f'arn:aws:iam::{account_id}:role/{role_name}',
            RoleSessionName='iam-audit'
        )['Credentials']

        iam = boto3.client('iam',
            aws_access_key_id=creds['AccessKeyId'],
            aws_secret_access_key=creds['SecretAccessKey'],
            aws_session_token=creds['SessionToken']
        )

        users = iam.list_users()['Users']
        for user in users:
            keys = iam.list_access_keys(UserName=user['UserName'])['AccessKeyMetadata']
            active_keys = [k for k in keys if k['Status'] == 'Active']
            if active_keys:
                findings.append({
                    'account': account_id,
                    'user': user['UserName'],
                    'active_keys': len(active_keys),
                    'created': user['CreateDate'].isoformat()
                })

    return findings

Run this across your org to find every IAM user with active access keys. That's your migration list.

Tips for migration:

• Start with read-only permission sets to build confidence
• Use permissions boundaries to block new IAM user creation
• Keep one break-glass IAM user per account with MFA and no access keys
• Set SCIM push frequency to the minimum your IdP supports