IAM Get Started confusion - IAM User Vs IAM Identity Centre User ?

Question

Im new to AWS own account and trying to understand **Getting Started 4 steps tutorials**.

**Step 2 Configure Users**

*Set up additional users* tell you to select IAM then IAM Indentity Centre so you can 2...create separate users for specific roles and functions. In this step, we will create an administrative user in IAM" thus an IAM User?

then *Configure your identity source* section again states "choose Users. Then, select Add user." presume im creating an IAM User?

finally *Sign in to the AWS access portal with your administrative credentials* click Accept Inivitiation and get a different looking signin screen than usual with just IAM User Name and Password.  Success I can login.

Now I have completed this and logged in with Success I try complete login test as my new IAM user.
I logout, open new browser to *https://.signin.aws.amazon.com/console* 
Prompted for Root or IAM User login.  
I choose IAM User, put my Account, my IAM User (just used) and its Password and get *Your authentication information is incorrect. Please try again*

I decide to login as Root and check my IAM dashboard to see zero Users and Groups.
I then recall I followed the guide and created under the IAM Identity Centre as the Getting Started Guide perscribes.  Sure enough the IAM Users are there but I cant login with them?

Now I am confused whats the different from IAM dashboard -> Users and IAM Indentity Centre -> Users and which is really the IAM User im suppose to login with?

Thanks in advance for any clarity/asisstance.

PS: I have now read (2-3hrs) so many guide in the docs on IAM, IAM login, IAM users, its all becoming a blurred mess.

PPS: I havent got to the confusion the Getting Start Guide has about just use the ACCESS KEY, SECRET KET for the user setup in last step as those keys are not even mentioned in the previous step (2).

Accepted Answer

IAM Identity Center enables you to manage workforce user access to multiple AWS accounts and cloud applications where as IAM user is the user, which is native to this account and would be able to access the account in which it was created.

Through IAM Identity Center, you can have identity source and enable permissions for multi accounts for same user where as for IAM user case, multi account access is not possible unless IAM user in Account A is granted permissions explicitly and other account(Account B) also allow that IAM user(in Account A) to have access to resources in Account B.

While creating IAM user, when you choose "Provide user access to the AWS Management Console", then AWS recommends to use IAM Identity Center instead of IAM user as through IAM Identity Center, it's lot easier to manage the users and their access across multiple aws accounts, contrary to that IAM user is just for that specific account where it's created.

I'm attaching a snapshot, which exactly tells why you should choose one over other.

![](/media/postImages/original/IMSXqwLbl4TriTxr7d7cLwSQ)

If you have created IAM user, then you can login through url https://.signin.aws.amazon.com/console and use the user name and password.

If you have created user in IAM Identity Center, then go to IAM Identity Center console, go to Users section then select the user, which you created and choose reset password:

It'll give you following two options:

1. Send an email to the user with instructions for resetting the password
2. Generate a one-time password and share the password with the user

Choose second one, reset it and after reset, pop up window will give you the login url and password, which you'd use to login.

AWS IAM Identity Center is a successor to AWS Single Sign On(SSO) and fits well to access multiple aws accounts.

Additionally take a look at https://repost.aws/questions/QUxQ4HoFtpTKeNFvHA4VoKKw/what-is-the-difference-between-a-user-created-in-iam-and-a-user-created-in-iam-identity-center

Hope it would help you to get clarity between two, feel free to comment here if you have further questions. If this answer helped you, please accept the answer.

#### PS: Unless, you don't have organizational requirement and necessarily have IAM Identity Center User(multi accounts access) requirement, IAM user would serve the purpose, which can be created as I mentioned in snapshot.

Answer

Also note that Identity Center and IAM Users have different login URLs, depending on the type only one of the two possibilities will work. 
Identity Center is typically recommended when you have a reasonable amount of users, and/or if you use Organizations to manage your workforce. Those users are not IAM users, but federated ones (even though they can be managed in AWS, if you're not using an external IdP).
Assuming that you refer to [this guide](https://docs.aws.amazon.com/SetUp/latest/UserGuide/setup-createadminuser.html), what you are using is **Identity Center**. Those are not IAM Users, and you'll need the login URL configured in Identity Center to log in.

IAM Get Started confusion - IAM User Vs IAM Identity Centre User ?

PS: Unless, you don't have organizational requirement and necessarily have IAM Identity Center User(multi accounts access) requirement, IAM user would serve the purpose, which can be created as I mentioned in snapshot.

Relevant content