Assigning user to accounts within an organisation in IAM Identity Center

Question

I have setup an organisation and added two more accounts to it (Account A an Account B). In IAM Identity Center I am trying to assing a user that I created to Accounts A and B with the AdministratorAccess role. I had already completed this process successfully for the management account. Every time I try to do this the process fails with the following error:

AWS SSO is unable to complete your request at this time. Obtaining permissions to manage your AWS account 'Account A' is taking longer than usual. Please try again in a few minutes. If this problem continues, contact AWS Support.

How can I resolve this issue?

Petri Kallberg · Accepted Answer

Have you checked this isnt because your SSO was setup to a region that isnt enabled on accounts you are trying to use? Something similar to https://repost.aws/questions/QUqpbbo1VSTMijNaZF6kOhjw/error-when-assigning-permission-sets-to-user-group

re:Post Agent · Answer

The issue you're experiencing with assigning a user to accounts within your organization using IAM Identity Center is not uncommon and can usually be resolved with a few troubleshooting steps:

1. Wait and retry: As the error message suggests, the process of obtaining permissions can sometimes take longer than expected. Wait for a few minutes (up to 15-20 minutes) and try the assignment process again. AWS systems may need time to propagate changes across their infrastructure.

2. Check account status: Ensure that the accounts you're trying to assign (Account A and Account B) are active and in good standing within your organization. Sometimes, account issues can prevent proper assignments.

3. Verify IAM Identity Center setup: Double-check that IAM Identity Center is correctly set up in your organization, particularly for the accounts you're trying to assign. This includes ensuring that the necessary service-linked roles exist in these accounts.

4. Re-provision the account: If the issue persists, try re-provisioning the problematic accounts in IAM Identity Center. This can be done by removing the account from IAM Identity Center and then re-adding it.

5. Check for conflicting policies: Look for any Service Control Policies (SCPs) or other organization-level policies that might be interfering with the assignment process.

6. Examine CloudTrail logs: Although the specific error might not be logged, CloudTrail may contain useful information about failed attempts or other related events that could help identify the root cause.

If none of these steps resolve the issue, it's advisable to contact AWS Support for further assistance. They can provide more detailed troubleshooting based on your specific account configuration and may be able to identify any underlying problems with your IAM Identity Center setup or account permissions.

Remember, when assigning permissions, it's generally recommended to use groups for scalability rather than assigning permissions to individual users. This makes it easier to manage access as your organization grows.

**Sources**  
[aws iam identity center user add account role | AWS re:Post](https://repost.aws/questions/QUgEhzCwP2RAyp2nx0rj2SqA/aws-iam-identity-center-user-add-account-role)  
[No access error during access to Management Console from the Access Portal for an IAM Identity Center's user with AdministratorAccess &/| PowerUserAccess permission sets | AWS re:Post](https://repost.aws/questions/QUMZcEHK1QTJ2F9LGuegh3fg/no-access-error-during-access-to-management-console-from-the-access-portal-for-an-iam-identity-center-s-user-with-administratoraccess-poweruseraccess-permission-sets)  
[Trouble accessing/logging in to new account | AWS re:Post](https://repost.aws/questions/QUJaqy9sQRQVCcSO51MZ40tw/trouble-accessing-logging-in-to-new-account)

Assigning user to accounts within an organisation in IAM Identity Center

Add your answer

Relevant content