AWS IAM Identity Center Access Reviews

AWS IAM Identity Center access reviews fail when someone exports assignments to a spreadsheet and asks managers to "confirm still needed." Identity Center is the right control plane for human AWS access. It is not a review product. The assignment graph spans accounts, permission sets, and groups — and unused assignments accumulate the same way IAM users used to.

We treat Identity Center as an entitlement source in the same ingest-normalize-review-remediate loop as Okta. The GRC platform you already run can store the campaign. It will not pull ListAccountAssignments across an Organization unless someone builds that collector.

Why Console Screenshots Fail CC6

Auditors sampling AWS logical access want:

• Who can assume which permission set in which account
• When that assignment was last certified
• Proof unused assignments were removed, not just "reviewed"

A screenshot of the Identity Center UI does not show last-used. CloudTrail AssumeRole on the permission set's role does. Pair Identity Center exports with IAM Access Analyzer unused access findings so managers are not certifying roles nobody has assumed in 90 days.

This is the AWS-admin sibling of privileged access review automation. Break-glass permission sets belong in a tighter cadence than ReadOnly.

Entitlement Model We Ingest

Each review row is (principal, permission_set, account_id, assignment_source).

• Principal — user or group. Groups are cheaper to operate and worse to review if the group is engineering with no owner.
• Permission set — the actual privilege. AdministratorAccess in a sandbox is not the same control as AdministratorAccess in prod.
• Account — Organizations account ID, tagged with env/owner.
• Source — direct assignment vs group. Direct user assignments are the smell; we ticket them for conversion or expiry.

# flatten Identity Center assignments into review rows
def rows(assignments: list[dict], last_used: dict[str, str]) -> list[dict]:
    out = []
    for a in assignments:
        key = f"{a['account']}:{a['permission_set']}:{a['principal']}"
        out.append({
            "principal": a["principal"],
            "permission_set": a["permission_set"],
            "account": a["account"],
            "last_assume": last_used.get(key, ""),
            "stale": last_used.get(key, "") == "",
        })
    return out

last_assume comes from CloudTrail Lake or Athena over the organization trail — the same trail we want in organization CloudTrail architecture. If you only have account-level trails, the review is already incomplete.

Cadence by Privilege, Not by Comfort

One quarterly campaign for every assignment is how prod-admin and sandbox-read get the same rubber stamp. Split the campaign or you will watch reviewers approve 400 rows in six minutes — a pattern auditors are trained to notice, as we cover in the quarterly access review runbook.

Federation First, Then Review

If humans still have long-lived IAM users, Identity Center reviews are rearranging furniture. Eliminate the users, then certify permission sets. That sequence is OIDC and federation, not a campaign setting.

See what an Access & Credential Governance Diagnostic finds in your AWS Organization → rutagon.com/contact · 907-841-8407 · contact@rutagon.com.

Last-Used Join

Athena SQL that joins permission-set role names to AssumeRole events is the difference between reviewing access and reviewing decorations. Unused prod-write for 90 days is a revoke candidate even if the manager "still wants it for emergencies." Emergencies are break-glass, recertified monthly.

Group explosion: a nested IdP group that pulls contractors into aws-prod-poweruser will look like one assignment in Identity Center and 40 humans in the IdP. Review both layers or you certify a Russian-doll.

Automation of Revoke

Revoke in Identity Center is DeleteAccountAssignment. We ticket first, then API, then confirm with a read-after-write. Never revoke org-admin in the same batch as a script bug. Break-glass is excluded from automated revoke without a dual control.

AWS IAM Identity Center access reviews that join last-used

AWS IAM Identity Center access reviews that dump every account assignment into a spreadsheet fail CC6 because they do not join last-used. We query CloudTrail AssumeRole for the permission-set role names and flag prod-write unused for 90 days. “Keep for emergencies” is break-glass, recertified monthly, not a standing assignment.

Nested IdP groups are Russian dolls: one Identity Center assignment, forty humans. Review both layers. AWS documents assignments in the Identity Center user guide. The engineering job is owner maps (permission set → account → human owner) and DeleteAccountAssignment after a ticket, with read-after-write.

Never auto-revoke org-admin in the same batch as a script bug. Break-glass is excluded from automated revoke without a dual control. Unused sandbox PowerUser can go faster.

Federation first: if engineers still have IAM users, you are reviewing the wrong plane. Kill the users, then campaign Identity Center. Otherwise you certify a shadow path.

Permission sets with AdministratorAccess are not a quarterly story

Those assignments are monthly, dual-control revoke, and ticket-on-use if they are break-glass. Mixing them into a 3,000-row quarterly campaign trains reviewers to rubber-stamp. Split the campaign. Identity Center access reviews for sandbox-readonly can be quarterly. Prod-write unused 90 days is a revoke candidate even if the manager is on PTO — the backup reviewer is in the RACI.

Last-used is CloudTrail, not the Identity Center UI. The UI will not save you in sampling.

Frequently Asked Questions

Does IAM Identity Center replace a GRC access-review tool?

No. Identity Center is how humans get AWS roles. A review tool (or a custom campaign) is how you prove those assignments are still authorized. We plug the export into the tool you already have.

How do we review group-based assignments?

Certify group membership and the permission sets attached to the group. Certifying only the group in Okta misses AWS-only groups created in Identity Center.

What about permission set session duration?

Long sessions (12 hours) are a standing-privilege lookalike. Review session duration with the assignment. Short sessions plus audit-logged assume-role is the privileged path.

Can we use AWS Audit Manager instead of building a collector?

Audit Manager can gather related evidence. It does not replace owner decisions or remediation tickets. Use it as a binder, not as the review workflow.

Do SCPs make permission-set reviews unnecessary?

SCPs are a ceiling. Assignments are still grants under that ceiling. Review both; they answer different auditor questions.