Cant assign already existing IAM Identity users to AWS IAM Identity for WorkMail

Hello.

You can add an existing IAM Identity Center user by following the steps in the document below.
Enter your IAM Identity Center username in the search box to see user suggestions.
https://docs.aws.amazon.com/workmail/latest/adminguide/assigning_usersandgroups.html

Assign Users – You can assign individual IAM Identity Center users to the Amazon WorkMail. You can either create a new IAM Identity Center user or search for an existing user.

If you enter your username as shown in the image below, it will appear in the search results.

By the way, after adding the IAM Identity Center user, you need to associate it with the Workmail user.
https://docs.aws.amazon.com/workmail/latest/adminguide/connecting_wmusers.html

I have tried to punch in the same details as the already existing IAM ID user and the system correctly detects it and marks it as duplicate. But how can there be any other permission when I am managing it from the Root account and the created account also doesnt have any new/other permission that the original IAM ID accounts dont. Is there any other possible solution? Also if its a bug in AWS, do I have to pay for the support tier or not?

Based on the information provided, it appears you're encountering an issue with assigning existing IAM Identity Center users to AWS WorkMail. This situation is not typical and may indicate a potential synchronization or configuration problem.

Here are a few points to consider:

1. IAM Identity Center (formerly AWS SSO) is designed to work seamlessly with AWS applications like WorkMail. Normally, you should be able to see and assign existing IAM Identity Center users to WorkMail.

2. The fact that you can create new users from the WorkMail console and have them appear in IAM Identity Center suggests that there is a connection between the two services, but it's not working as expected for existing users.

3. Disabling the "require assignment of users" option is a workaround, but as you've noted, it prevents you from using MFA, which is not ideal for security.

To resolve this issue, you could try the following:

1. Ensure that your IAM Identity Center is properly configured as the identity source for WorkMail.

2. Check if there are any pending synchronization tasks or if a manual sync is required between IAM Identity Center and WorkMail.

3. Verify that the IAM Identity Center users have the necessary permissions to be assigned to WorkMail.

4. Try logging out and back in to both the IAM Identity Center and WorkMail consoles to refresh the session.

If these steps don't resolve the issue, it may indeed be a bug in the AWS services. In that case, contacting AWS Support would be the best course of action. While paying for support can be an additional expense, it might be necessary to resolve this kind of complex integration issue, especially if it's preventing you from implementing important security features like MFA.

In the meantime, as a temporary workaround, you could consider creating duplicate users directly from the WorkMail console for your existing IAM Identity Center users. However, this is not an ideal long-term solution as it creates management overhead and potential synchronization issues.
Sources
Using IAM Identity Center for user access to applications only - AWS IAM Identity Center
Get started with common tasks in IAM Identity Center - AWS IAM Identity Center
Connect workforce users - AWS IAM Identity Center
Assign user access to applications in the IAM Identity Center console - AWS IAM Identity Center