Cannot enable Identity Center / SSO due to loop of warnings and redirects

Question

I have a brand new AWS account where I need multiple accounts and OUs. I am trying to set up Identity Center, which I understand is best practice (vanilla and normal).

On my Identity Center page in the console I see:

```
This instance of IAM Identity Center doesn't have trusted access to your organization.
Enable trusted access for IAM Identity Center on the Services page in the AWS Organizations console 
.
```
When I follow the instructions and navigate to " the Services page in the AWS Organizations console" that tells me I should use Identity Center (singlesignon) and if I don't an incompolete configuration may result, as that does other operations that are quite mysterious, but apparently important. It says:

```Enable trusted access for AWS IAM Identity Center (AWS Single Sign-On)?
We recommend that you enable trusted access by using the AWS IAM Identity Center (AWS Single Sign-On) console.

Enabling trusted access through the AWS IAM Identity Center (AWS Single Sign-On) console enables that service to complete additional setup tasks that might be required.
```
Then has a checkbox that says that if I proceed some setup will not be done properly: 
`Show the option to enable trusted access for AWS IAM Identity Center (AWS Single Sign-On) without performing additional setup tasks.`

So the main Identity Center page and the organizations > Services > singlesignon page (https://us-east-1.console.aws.amazon.com/organizations/v2/home/services/AWS%20IAM%20Identity%20Center%20(AWS%20Single%20Sign-On)) are both referring me to each other in a loop.

Note: previously I did see an "enable Identity Manger" link in IAM console, but when I tried that I got "rate exceeded" and when I tried again minutes later (10+) it still had that error.

This seems like basic setup, and it is pretty severe/serious that basic links from a fresh start do not work.

re:Post Agent · Answer

The issue you're experiencing is a common one when setting up IAM Identity Center (formerly known as AWS Single Sign-On) in a new AWS account. The loop of warnings and redirects you're encountering is due to the interdependence between IAM Identity Center and AWS Organizations.

To resolve this issue, you should follow these steps:

1. First, ensure that you have set up AWS Organizations. If you haven't already done so, you need to create an organization from your AWS account, which will become the management account.

2. Once AWS Organizations is set up, go to the IAM Identity Center console.

3. In the IAM Identity Center console, look for an option to "Enable IAM Identity Center" or "Enable Identity Center". Click on this option to begin the setup process.

4. During the setup, AWS will automatically create an organization for you if one doesn't exist, or use your existing organization.

5. You may need to verify your email address associated with the management account. AWS Organizations will send a verification email, which you should respond to within 24 hours.

6. If you encounter a "rate exceeded" error, wait for a longer period (30 minutes to an hour) before trying again. These errors can occur due to AWS's internal processes and usually resolve themselves given some time.

7. If you're still having trouble, you might need to delete your existing IAM Identity Center configuration (if any) and start over. You can do this by going to IAM Identity Center > Settings > Management and deleting the existing configuration.

8. After deletion, create an AWS Organization (if not already done), then re-enable IAM Identity Center.

Remember, IAM Identity Center should be enabled in the management account of your AWS Organization. This setup allows you to centrally manage access across multiple accounts and is indeed considered a best practice for multi-account environments.

If you continue to experience issues after following these steps, it may be worth contacting AWS Support for further assistance, as there could be account-specific factors at play.
      
**Sources**  
[IAM Identity Center cannot be enabled | AWS re:Post](https://repost.aws/questions/QUiXu2tb9QSsi7AuzynsZyPg/iam-identity-center-cannot-be-enabled)  
[I can't enable IAM Identity Center service | AWS re:Post](https://repost.aws/questions/QUOC8GpTrgSA6An0Ey0iNHOw/i-can-t-enable-iam-identity-center-service)  
[Cannot add permissions in IAM Identity Center | AWS re:Post](https://repost.aws/questions/QUdcvfutLfR2iZssChF1ZfHg/cannot-add-permissions-in-iam-identity-center)

Advocara-D · Answer

Solved.

I had a single management account under a "root" organization, and I deleted the organization, then was able to go to Identity Manager in the console and the Enable Identity Manger did work.

This is a new configuration / new account setup (totally new: new credit card, email, etc. vs new Organization or Account resource in an existing setup) so I was not very worried about deleting.

note: going forward, I will use Terraform .tf for pretty much everything to simplify rebuilding if I again get into a bad state where AWS advice and procedures no longer work.

I believe the earlier attempt that reported Rate Error caused a partial configuration to be left in place. Deleting and trying again solved it. I had set up an authorization group and a couple things, which probably put me over the limit halfway through the Identity Center setup. Unsure.

Cannot enable Identity Center / SSO due to loop of warnings and redirects

Add your answer

Relevant content