> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/aws/identity-center-merged.md).

# Identity Center (merged)

{% hint style="info" %}
This login type is in beta.
{% endhint %}

Choose the **Identity Center (merged permission set)** login type to provision access through a single shared Identity Center permission set per user, rather than creating a new permission set for each access request. Each request attaches its own customer-managed policy to the shared permission set, which avoids Identity Center permission-set sprawl.

This method requires a separately installed AWS Identity Center (merged) integration on the account that hosts the Identity Center instance. Install it first, then select the merged login type on your AWS IAM management integration.

## Prerequisites

* An [AWS IAM management integration](/integrations/resource-integrations/aws/installation-methods.md) installed on the account that hosts the Identity Center instance.
* The AWS Identity Center (merged) integration installed on the same account. See [Install the AWS Identity Center (merged) integration](#install-the-aws-identity-center-merged-integration).

## Install the AWS Identity Center (merged) integration

Install the AWS Identity Center (merged) integration on the AWS account that hosts your Identity Center instance, typically your management or delegated administrator account. With this integration, P0 manages a single shared permission set per user and attaches a per-request customer-managed policy to it, instead of creating a separate permission set for every request.

1. Navigate to **Integrations** on [p0.app](https://p0.app), then select the **AWS MIDC** integration.
2. Enter the AWS account ID of the account that hosts the Identity Center instance.
3. Enter the AWS region where Identity Center is installed (for example, `us-east-1`). This region must match the region where your Identity Center instance resides.
4. Select the AWS partition: `aws` for commercial regions or `aws-us-gov` for GovCloud.
5. Run the displayed AWS CLI commands to provision P0's access. You can also run these commands using AWS Cloud Shell. These commands create the `P0RoleMergedIdc` role, which grants P0 permission to manage Identity Center permission sets and account assignments.
6. Click **Next** to verify the installation.
7. After verification, choose how P0 identifies users in Identity Center:
   * **Username is user's email** (default): P0 matches users by their Identity Center user name.
   * **User's IDC email is user's email**: P0 matches users by the email attribute on their Identity Center profile.

### Install with Terraform

You can install the AWS Identity Center (merged) integration with the [P0 Terraform provider](https://registry.terraform.io/providers/p0-security/p0/latest/docs) instead of the P0 app. Use the [`p0_aws_midc_staged`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/aws_midc_staged) resource to generate the role's trust and inline policies, create the `P0RoleMergedIdc` role from them, then use the [`p0_aws_midc`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/aws_midc) resource to complete the install.

```terraform
resource "p0_aws_midc_staged" "staged_account" {
  id         = "123456789012" # The account that hosts the Identity Center instance
  idc_region = "us-east-1"     # The region where Identity Center is installed
}

resource "aws_iam_role" "p0_midc_manager" {
  name               = p0_aws_midc_staged.staged_account.role.name
  assume_role_policy = p0_aws_midc_staged.staged_account.role.trust_policy
}

resource "aws_iam_role_policy" "p0_midc_manager" {
  name   = p0_aws_midc_staged.staged_account.role.inline_policy_name
  role   = aws_iam_role.p0_midc_manager.name
  policy = p0_aws_midc_staged.staged_account.role.inline_policy
}

resource "p0_aws_midc" "installed_account" {
  id         = p0_aws_midc_staged.staged_account.id
  idc_region = p0_aws_midc_staged.staged_account.idc_region
  partition  = p0_aws_midc_staged.staged_account.partition
  depends_on = [aws_iam_role_policy.p0_midc_manager]
}
```

Run `terraform init` and `terraform apply`.

## Configure the merged login type

After you install the AWS Identity Center (merged) integration, return to your AWS IAM management configuration, select **Via AWS Identity Center (merged permission set)**, choose the account that hosts the Identity Center instance, then click **Next**.

If you install with Terraform, configure the `merged-idc` login type on the AWS account's `aws_iam_write` resource to provision access through the merged permission set.

## Related

* [Identity Center](/integrations/resource-integrations/aws/installation-methods/identity-center.md)
* [Requesting AWS access](/integrations/resource-integrations/aws/requesting-access.md)
* [Setting up AWS IAM management](/integrations/resource-integrations/aws/installation-methods.md)