Skip to main content

Set up AWS IAM Identity Center (AWS SSO)

Follow this page only if your organization has not yet configured IAM Identity Center. If it has, skip to Connect AWS SSO and ask your AWS administrator for the details listed in Step 5.

Step 1: Enable IAM Identity Center​

  1. Sign in to the AWS Management Console with your management account.
  2. Navigate to IAM Identity Center (search for "IAM Identity Center" in the AWS console search bar).
  3. Click Enable to activate IAM Identity Center.
  4. Choose your preferred identity source:
    • IAM Identity Center directory (default) — Simplest option; create and manage users directly in AWS.
    • Active Directory — Connect to your existing AWS Managed Microsoft AD or self-managed AD.
    • External identity provider — Integrate with Okta, Azure AD (Entra ID), Google Workspace, or other SAML 2.0/SCIM providers.
tip

For most setups, the IAM Identity Center directory (built-in) is the quickest option to get started. You can change the identity source later if needed.

Step 2: Create Users and Groups​

  1. In the IAM Identity Center console, go to Users → Add user.
  2. Fill in the user details:
    • Username — A unique identifier (e.g., jdoe)
    • Email address — The user's email for notifications and password setup
    • First name and Last name
  3. The user will receive an email to set up their password.
  4. (Optional) Create groups for easier access management:
    • Go to Groups → Create group
    • Name the group (e.g., Developers, DataEngineers)
    • Add users to the group

Step 3: Create Permission Sets​

Permission sets define the level of AWS access a user or group receives:

  1. In IAM Identity Center, go to Permission sets → Create permission set.
  2. Choose the type:
    • Predefined permission set — Select from AWS managed policies:
      • AdministratorAccess — Full access to all AWS services
      • ReadOnlyAccess — Read-only access to all services
      • PowerUserAccess — Full access except IAM and Organizations management
      • ViewOnlyAccess — View resources without read access to data
    • Custom permission set — Define a custom IAM policy for fine-grained control
  3. Configure session duration (default is 1 hour; maximum is 12 hours).
  4. Click Create to save the permission set.
info

The permission set you assign determines what the AWS Tool in Abacus.AI can do. For example, if you assign ReadOnlyAccess, the tool can list and describe resources but cannot create or modify them.

Step 4: Assign Users to AWS Accounts​

  1. Go to AWS accounts in IAM Identity Center.
  2. Select the AWS account you want to grant access to.
  3. Click Assign users or groups.
  4. Select the user or group to assign.
  5. Choose the permission set to attach.
  6. Click Submit to complete the assignment.

Step 5: Locate Your SSO Details​

After setup, gather these details for the Abacus.AI connector:

DetailWhere to Find It
SSO Start URLIAM Identity Center → Settings → Identity source section → Look for the AWS access portal URL (e.g., https://mycompany.awsapps.com/start)
SSO RegionThe AWS region where IAM Identity Center is enabled (e.g., us-east-1). Visible in the top-right corner of the IAM Identity Center console.
AWS Account IDThe 12-digit account ID visible on the AWS accounts page in IAM Identity Center, or in My Account in the AWS console.
SSO Role NameThe name of the permission set assigned to your user (e.g., AdministratorAccess, ReadOnlyAccess, or your custom permission set name).

Next step​

Connect AWS SSO to Abacus.AI.