How do I use IAM Identity Center permission sets?

Resolution

To use IAM Identity Center permission sets to grant users and groups access to an account, create a permission set. Then, assign users and groups in the account. Finally, confirm in the user portal that the users and groups have the correct permissions.

Create a ViewOnlyAccess permission set

1. Open the IAM Identity Center console.
2. In the navigation pane, under Multi-Account permissions, choose Permission sets.
3. Choose Create permission set.
4. On the Select permission set type page, under Permission set type, choose Predefined permission set.
5. Under Policy for predefined permission set, choose ViewOnlyAccess, and then choose Next.
6. On the Specify permission set details page, choose Next.
7. On the Review and create screen, choose Create.
   Note: The console displays "The permission set "ViewOnlyAccess" was successfully created."

Assign permission sets to the accounts

1. Open the IAM Identity Center console.
2. In the navigation pane, under Multi-account permissions, choose AWS accounts.
3. On the AWS accounts page, select one or more AWS accounts where you want to assign single sign-on access.
4. Choose Assign users or groups.
5. On the Assign users and groups to AWS-account-name, for Selected users and groups, choose the users for the permission set.
6. Choose Next.
7. On the Review and submit assignments to AWS-account-name page, for Review and submit, choose Submit.
   Note: The console displays "We reprovisioned your AWS account successfully and applied the updated permission set to the account."

Verify that the user has ViewOnlyAccess permissions

1. Open the IAM Identity Center console.
2. In the navigation pane, choose Dashboard.
3. On the Settings page, under Summary, choose AWS access portal URL.
4. Use your IAM Identity Center user name and password to log in to the access portal.
5. Choose AWS Account.
6. Choose the Account dropdown list to view the ViewOnlyAcccess permissions.
7. For the ViewOnlyAccess permissions, choose Management console.