Multiple Organizations & IAM Identity Center SSO

Question

Hi,

I have multiple organizations in my account hierarchy. We're using multiple organizations as each needs to be billed separately (different countries).
Is it possible to have a single instance of IAM Identity Center to enable SSO across multiple organizations?

Note: Multiple organizations is a suggested approach per AWS documentation - https://d0.awsstatic.com/aws-answers/AWS_Multi_Account_Billing_Strategy.pdf

Answer

No, Identity Center supports one AWS Organizations at a time. In your situation, if you want to keep separate Organization per customer, you will need to setup Identity Center in each Organization's management account. Each of these Identity Centers/Organizations can then point to the same IdP.

Answer

I believe the document you referenced recommends that you use Organizational Units (OUs) within your AWS Organization.
This is what we are doing and it allows us to generate bills for each OU as well as shows us total spending across the enterprise.

Multiple Organizations & IAM Identity Center SSO

Contenuto pertinente