Sync users from Identity Center to AWS Account IAM

The AWS account administrator cannot directly manage IAM Identity Center users and groups within their individual AWS account, as IAM Identity Center is managed at the organization level. However, there are a few approaches the account administrator can take to grant access to services within their account:

1. Use Permission Sets: The organization-level IAM Identity Center administrator should create appropriate permission sets that define the access levels needed for different groups. The account administrator can then work with the Identity Center admin to assign these permission sets to the relevant users or groups for their specific AWS account.

2. Create IAM Roles: The account administrator can create IAM roles within their AWS account that correspond to the different access levels required. These roles can then be assumed by the IAM Identity Center users when they access the account.

3. Utilize IAM Policies: The account administrator can create and manage IAM policies within their account. These policies can be attached to the IAM roles that are assumed by IAM Identity Center users, allowing fine-grained control over permissions within the account.

4. Request Updates: The account administrator should communicate with the organization's IAM Identity Center administrator to request updates to permission sets or group assignments as needed for their account.

5. Use AWS Organizations Service Control Policies (SCPs): If the account is part of an AWS Organization, the account administrator can work with the organization admin to implement SCPs that define guardrails for permissions across accounts.

It's important to note that while the account administrator cannot directly manage IAM Identity Center users and groups, they can still control access within their account through careful management of IAM roles and policies. This approach allows for maintaining centralized identity management through IAM Identity Center while still providing account-level control over resource access.

Sources
aws iam identity center user add account role | AWS re:Post
Using IAM access centre and federation in one account | AWS re:Post