Temporary elevated access with Entra ID SSO

AWS Documentation: https://docs.aws.amazon.com/singlesignon/latest/userguide/temporary-elevated-access.html

If you have ENTRA for your SSO provider, and have the appropriate enterprise license level, there is a Privileged Access workflow. The feature is called PIM, or Privileged Identity Management.
Microsoft Documentation: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

There's an AWS security blog post describing how to integrate Entra PIM with Identity Center: https://aws.amazon.com/blogs/security/implementing-just-in-time-privileged-access-to-aws-with-microsoft-entra-and-aws-iam-identity-center/

There are a couple of trade-offs in the way the PIM solution integrates with Identity Center to be aware of, but these usually aren't showstoppers. PIM works by just-in-time provisioning a group membership and syncing that to IdC over SCIM, in order to elevate / de-elevate a user's access. That has the following implications:

1. Replication time. The IdC SCIM interface is asynchronous and changes to group memberships can take a while to sync to IdC.

From the blog post mentioned above:

In most situations, Entra ID group membership changes will be synchronized to IAM Identity Center within 2–10 minutes but can revert to the standard 40-minute interval if activity runs up against Entra PIM throttling limits.

2. Scope of elevated access. When you elevate access through PIM, because it dynamically makes you a member of an existing group, you get access to all the roles and accounts the group is (statically) linked to in IdC for the duration of your elevated access. If you want users to elevate access more granularly (e.g. to access 1 role in 1 account) then you might need to create a larger number of groups to handle that.