Does using the IAM Identity Center affect my IAM identities or federation configuration?
"I want to use the AWS IAM Identity Center (successor to AWS Single Sign-On) to provide access for users to our AWS accounts and applications. I want to know if using the IAM Identity Center affects my AWS Identity and Access Management (IAM) identities (users, groups, and roles)."
"I want to use the AWS IAM Identity Center (successor to AWS Single Sign-On) to provide access for users to our AWS accounts and applications. I want to know if using the IAM Identity Center affects my AWS Identity and Access Management (IAM) identities (users, groups, and roles).Short descriptionYou can use the IAM Identity Center or IAM to federate your workforce into AWS accounts and applications.IAM federation allows you to activate a separate SAML 2.0 or an OIDC IdP for each AWS account and user attributes for access control. You can use identity providers instead of creating IAM users in your AWS account. For more information, see Identity providers and federation.IAM Identity Center uses IAM service-linked roles. You don't have to manually add permissions with service-linked roles. For more information, see Using service-linked roles for IAM Identity Center.ResolutionThe IAM Identity Center is independent of identity federation configured using IAM. Using the IAM Identity Center doesn't impact IAM identities or your federation configuration.The IAM Identity Center uses the service-linked role AWSServiceRoleForSSO to grant permissions to manage AWS resources. The AWSServiceRoleForSSO role created in AWS accounts only trusts the IAM Identity Center service that's similar to the following IAM trust policy:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "Service":"sso.amazonaws.com"      },      "Action": "sts:AssumeRole"    }  ]}The IAM roles created by the service-linked role AWSServiceRoleForSSO have an IAM trust policy that's similar to the following:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "Federated": "arn:aws:iam::AWS-account-ID:saml-provider/AWSSSO_ec48a2d3f5dc369d_DO_NOT_DELETE"      },      "Action": "sts:AssumeRoleWithSAML",      "Condition": {        "StringEquals": {          "SAML:aud": "https://signin.aws.amazon.com/saml"        }      }    }  ]}Note: This IAM policy only trusts the SAML provider created automatically by the IAM Identity Center.With IAM federation, you must manually create IAM roles in your AWS accounts using a trust policy that's similar to the following:{  "Version": "2012-10-17",  "Statement": [{    "Effect": "Allow",    "Principal": {"Federated": "arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:saml-provider/MYIDP"},    "Action": "sts:AssumeRoleWithSAML",    "Condition": {"StringEquals": {      "saml:edupersonorgdn": "ExampleOrg",      "saml:aud": "https://signin.aws.amazon.com/saml"    }}  }]}Note: Only IAM entities in your organization with this policy attached are able to access your AWS accounts.To configure the IAM identity Center, see How do I get started with using IAM Identity Center and access the AWS access portal?Related informationHow to create and manage users within AWS IAM Identity CenterHow do I assign user access to cloud applications in the IAM Identity Center?How do I use IAM Identity Center permission sets?Identity federation in AWSFollow"