AWS IAM Identity Center, AWS Organizations, and IAM work together to provide comprehensive identity and access management, but they serve different purposes.

Let me clarify how these services work together and how to set up your environment:

AWS Organizations is the foundation that allows you to centrally manage and govern multiple AWS accounts. It's not primarily for user management but for account organization. You should set up AWS Organizations first, with your existing account becoming the management account.

IAM Identity Center (formerly AWS SSO) is designed for managing human users across your organization. It provides single sign-on access to all your AWS accounts and applications. This is where you'll create and manage your users and groups.

IAM is primarily for creating roles and policies that define permissions within individual AWS accounts. While IAM can create users, AWS recommends using IAM Identity Center for human users.

For your setup:

1. First, ensure AWS Organizations is properly configured with your main account as the management account.

2. In AWS Organizations, create member accounts for different environments or purposes (e.g., Production, Staging, Development, Billing). These accounts don't represent humans but rather logical separations of your AWS resources. You'll need unique email addresses for each account, but these are just for account creation and notifications.

3. In IAM Identity Center, you've already created your users and groups correctly. The next step is to assign permission sets to these groups for specific accounts:

• For Jon Doe (Admin group): Assign the AdministratorAccess permission set to all accounts
• For Jeanne Doe (PowerUser group): Assign PowerUserAccess to the Production account
• For Donald Duck (PowerUser group): Assign PowerUserAccess to the Staging account only
• For Mad Max (Billing group): Assign the Billing permission set to all accounts or just the management account

To make these assignments:

• Go to IAM Identity Center console
• Select "AWS accounts" from the navigation pane
• Select the AWS Organization or specific accounts
• Choose "Assign users or groups"
• Select the appropriate group
• Choose the permission set to assign
• Complete the assignment

For CLI access, your users will need to configure AWS CLI with IAM Identity Center. They'll use the "aws configure sso" command and follow the prompts to set up their credentials.

This approach gives you centralized user management through IAM Identity Center while maintaining proper separation of duties across your AWS accounts organized in AWS Organizations.
Sources
IAM Identity Center and AWS Organizations - AWS IAM Identity Center
AWS IAM Identity Center and AWS Organizations - AWS Organizations
Configure access to AWS accounts - AWS IAM Identity Center
features