Question

A company with 40 AWS accounts under AWS Organizations currently uses direct SAML 2.0 federation, configuring an individual SAML identity provider and set of IAM roles in each member account. Administrators complain that onboarding a new account requires manually replicating dozens of IAM roles and trust configurations, and that access reviews are difficult because entitlements are scattered across accounts. The security team wants a solution that centralizes workforce access assignment, integrates with their existing external SAML IdP, and minimizes per-account IAM role maintenance. Which approach best meets these requirements?

Accepted Answer

Deploy AWS IAM Identity Center with the external IdP as the identity source, and use permission sets assigned to accounts and groups to provision access centrally.

Answer

Create a single centralized IAM identity account, define all roles there, and have users assume roles cross-account via sts:AssumeRole role chaining into each member account.

Answer

Continue with direct SAML federation but use AWS CloudFormation StackSets to replicate the IAM SAML provider and roles automatically to every account.

Answer

Configure Amazon Cognito user pools federated with the SAML IdP and issue temporary credentials to workforce users for each account.