Can I keep existing IAM users and add SSO to our accounts
We currently have several accounts all using IAM - users, roles policies. We would like to improve how we manage our users by using SSO with our active directory account so that we have a centralised location for our users.
We also have users that are for external service providers (people) and applications that are not in our active directory.
Are we able to use the SSO for our users and then manage our other users in IAM or is having both SSO users and IAM users incompatible?
What happens to our existing IAM users if we active the SSO?
SSO and IAM users can coexist. Nothing happens to your existing IAM users, groups, roles or policies when you provision SSO into your accounts.
SSO appears as a new identity provider in your IAM config and manages its own roles (permission sets) alongside your normal IAM roles. Users coming in via SSO roles can also assume other IAM roles (with the right permissions), though watch out for condition strings in policies as things like MFA constraints don't work for SSO users.
Overall AWS SSO is a benefit, but be prepared for a small learning curve and extra work on the governance side as AWS SSO is less mature than IAM and seems to be taking a while to catch up.
Reuse or link IAM users and groups from Management Account to a new AWS account / OUAccepted Answerasked 5 months ago
How to use EKS with AWS SSOasked 9 months ago
Does Amazon QuickSight have a user limit?Accepted Answerasked 2 years ago
IAM users/roles/groups policies reportsAccepted Answerasked 5 months ago
EKS Fargate: restrict access to service to only certain podsasked 2 months ago
Can I keep existing IAM users and add SSO to our accountsasked 2 years ago
AWS Service Catalog. Grant SSO Users to the Portfolioasked 17 days ago
Set the access permission of objects in S3 bucketsasked 2 months ago
AWS SSO and multiple regionsasked 2 months ago
Public IPs - List all in Organizationasked 2 years ago