1 Answer
1
SSO and IAM users can coexist. Nothing happens to your existing IAM users, groups, roles or policies when you provision SSO into your accounts.
SSO appears as a new identity provider in your IAM config and manages its own roles (permission sets) alongside your normal IAM roles. Users coming in via SSO roles can also assume other IAM roles (with the right permissions), though watch out for condition strings in policies as things like MFA constraints don't work for SSO users.
Overall AWS SSO is a benefit, but be prepared for a small learning curve and extra work on the governance side as AWS SSO is less mature than IAM and seems to be taking a while to catch up.
answered 2 years ago
Relevant questions
Account level IAM vs IAM Identity Center
Accepted Answerasked 15 days agoReuse or link IAM users and groups from Management Account to a new AWS account / OU
Accepted Answerasked 10 months agoAssume Role for SSO Users
asked 9 months agoShare Cloud9 env with SSO users
asked 2 months agoHow to use IAM users, groups and roles with SSO
asked 4 months agoCan I keep existing IAM users and add SSO to our accounts
asked 2 years agoAWS Service Catalog. Grant SSO Users to the Portfolio
asked 5 months agoIAM users/roles/groups policies reports
Accepted Answerasked 9 months agoAWS Quicksight Access - via Amazon Active Directory AND IAM Roles
asked 3 months agoMigrate IAM Users to AWS SSO
asked 4 months ago