Identity Center (merged)

Install the AWS Identity Center (merged) integration and configure the merged login type so P0 provisions access through a single shared permission set per user, avoiding Identity Center permission-se

This login type is in beta.

Choose the Identity Center (merged permission set) login type to provision access through a single shared Identity Center permission set per user, rather than creating a new permission set for each access request. Each request attaches its own customer-managed policy to the shared permission set, which avoids Identity Center permission-set sprawl.

This method requires a separately installed AWS Identity Center (merged) integration on the account that hosts the Identity Center instance. Install it first, then select the merged login type on your AWS IAM management integration.

Prerequisites

• An AWS IAM management integration installed on the account that hosts the Identity Center instance.

• The AWS Identity Center (merged) integration installed on the same account. See Install the AWS Identity Center (merged) integration.

Install the AWS Identity Center (merged) integration

Install the AWS Identity Center (merged) integration on the AWS account that hosts your Identity Center instance, typically your management or delegated administrator account. With this integration, P0 manages a single shared permission set per user and attaches a per-request customer-managed policy to it, instead of creating a separate permission set for every request.

1. Navigate to Integrations on p0.app, then select the AWS MIDC integration.

2. Enter the AWS account ID of the account that hosts the Identity Center instance.

3. Enter the AWS region where Identity Center is installed (for example, us-east-1). This region must match the region where your Identity Center instance resides.

4. Select the AWS partition: aws for commercial regions or aws-us-gov for GovCloud.

5. Run the displayed AWS CLI commands to provision P0's access. You can also run these commands using AWS Cloud Shell. These commands create the P0RoleMergedIdc role, which grants P0 permission to manage Identity Center permission sets and account assignments.

6. Click Next to verify the installation.

7. After verification, choose how P0 identifies users in Identity Center:

   • Username is user's email (default): P0 matches users by their Identity Center user name.

   • User's IDC email is user's email: P0 matches users by the email attribute on their Identity Center profile.

Install with Terraform

You can install the AWS Identity Center (merged) integration with the P0 Terraform provider instead of the P0 app. Use the p0_aws_midc_staged resource to generate the role's trust and inline policies, create the P0RoleMergedIdc role from them, then use the p0_aws_midc resource to complete the install.

resource "p0_aws_midc_staged" "staged_account" {
  id         = "123456789012" # The account that hosts the Identity Center instance
  idc_region = "us-east-1"     # The region where Identity Center is installed
}

resource "aws_iam_role" "p0_midc_manager" {
  name               = p0_aws_midc_staged.staged_account.role.name
  assume_role_policy = p0_aws_midc_staged.staged_account.role.trust_policy
}

resource "aws_iam_role_policy" "p0_midc_manager" {
  name   = p0_aws_midc_staged.staged_account.role.inline_policy_name
  role   = aws_iam_role.p0_midc_manager.name
  policy = p0_aws_midc_staged.staged_account.role.inline_policy
}

resource "p0_aws_midc" "installed_account" {
  id         = p0_aws_midc_staged.staged_account.id
  idc_region = p0_aws_midc_staged.staged_account.idc_region
  partition  = p0_aws_midc_staged.staged_account.partition
  depends_on = [aws_iam_role_policy.p0_midc_manager]
}

Run terraform init and terraform apply.

Configure the merged login type

After you install the AWS Identity Center (merged) integration, return to your AWS IAM management configuration, select Via AWS Identity Center (merged permission set), choose the account that hosts the Identity Center instance, then click Next.

If you install with Terraform, configure the merged-idc login type on the AWS account's aws_iam_write resource to provision access through the merged permission set.

Related

• Identity Center

• Requesting AWS access

• Setting up AWS IAM management