Feature request: query IAM Identity Center users and group by ExternalId alone

Thank you for your feature request regarding querying IAM Identity Center users and groups by ExternalId alone. While this functionality is not currently available, I understand the challenge you're facing when managing or migrating permission set assignments across multiple management accounts or IAM Identity Center instances.

Currently, IAM Identity Center requires both the ExternalId and the Issuer to uniquely identify users and groups across different instances. The ExternalId alone is not sufficient, as it's designed to be unique within a single identity provider but may not be globally unique across all providers.

Your suggestion to modify GetUserId and GetGroupId to return results based on just the ExternalId.Id without the Issuer is an interesting proposal. However, this could potentially lead to conflicts if two different identity providers use the same ExternalId for different users or groups.

The idea of adding ListUserId and ListGroupId operations that could take just the ExternalId is another interesting approach. This could potentially return a list of matching users or groups across all connected identity providers, which you could then filter as needed.

Your suggestion to make ListProvisioningTenants available through user-facing APIs and CLI tools is also worth considering. This would indeed allow users to query the Issuer information programmatically, which could be helpful in scenarios like yours.

While these features are not currently available, AWS regularly updates and improves its services based on customer feedback. I recommend submitting your feature request directly to AWS through their official channels. This could include contacting AWS Support, posting on the AWS forums, or reaching out to your AWS account representative if you have one.

In the meantime, you might need to continue using the current methods of querying users and groups, which involve knowing both the ExternalId and the Issuer. You could potentially create a mapping of Issuers to ExternalIds in your management process to help streamline your workflows across different IAM Identity Center instances.
Sources
AWS IAM Identity Center Features – Amazon Web Services (AWS)
AWS IAM Identity Center now supports search by permission set name - AWS