Automate IAM Identity Center governance with continuous discovery and reporting

<a class="Link" href="https://aws.amazon.com/iam/identity-center" target="_blank" rel="noopener" data-cms-ai="0">AWS IAM Identity Center</a> integrates with <a class="Link" href="https://docs.aws.amazon.com/singlesignon/latest/userguide/how-to-connect-idp.html" target="_blank" rel="noopener" data-cms-ai="0">external identity provider (IdP)</a> to provide customers with a centralized authentication and authorization solution for AWS resources across <a class="Link" href="https://aws.amazon.com/organizations" target="_blank" rel="noopener" data-cms-ai="0">AWS Organizations</a>. AWS continues to invest into IAM Identity Center with a growing number of <a class="Link" href="https://docs.aws.amazon.com/singlesignon/latest/userguide/awsapps-that-work-with-identity-center.html" target="_blank" rel="noopener" data-cms-ai="0">AWS services that natively integrate with IAM Identity Center</a>. As your AWS organization scales, maintaining visibility into who has access to which applications and enforcing governance policies across accounts and Regions becomes increasingly complex. Identity Center helps address this by centralizing authentication and authorization for AWS resources across your organization, integrating with your external identity provider and a growing number of AWS services. However, as adoption scales, tracking access assignments and enforcing governance policies consistently becomes its own challenge.

This blog post focuses on planning your integration between an identity provider and IAM Identity Center for managed applications in your organization. We also walk through deploying and using an automated Identity Center discovery and reporting sample solution to help answer the governance and security questions:

<li>Which users or groups have access to which AWS applications?</li>

<li>Who last accessed a specific AWS application and when?</li>

<li>Which users and groups are assigned to which IAM Identity Center applications across organization and AWS Regions?</li>

<li>How can you quickly generate reports to assist with compliance audits or security reviews?</li>

</ol>

The sample solution will identify associated AWS applications and the corresponding user and group assignments for the IAM Identity Center instances within your organization. The output is stored in a queryable format and generates CSV files for downstream analysis or reporting.

<h2>Plan identity governance for Identity Center application assignments </h2>

</div>

There are four key areas to start on when planning how to manage delegation and provisioning access across IAM Identity Center managed AWS applications. Bring together key stakeholders across security, governance, application, and business teams to make sure the implementation and integration will fit into the overall identity governance strategy.

<li>Who can provision managed AWS applications: You can implement the IAM restrictions for creation of new AWS resources within AWS accounts in your organization. For example, if you restrict provisioning into a production AWS account to only infrastructure as code (IaC) IAM roles, you would continue implementing restrictions using AWS identity policies, <a class="Link" href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html" target="_blank" rel="noopener" data-cms-ai="0">service control policies (SCP)</a>, <a class="Link" href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_rcps.html" target="_blank" rel="noopener" data-cms-ai="0">resource control policies (RCP)</a>, or IaC policy evaluation tools like <a class="Link" href="https://www.openpolicyagent.org/docs/deploy/aws" target="_blank" rel="noopener" data-cms-ai="0">Open Policy Agent (OPA)</a> or <a class="Link" href="https://www.checkov.io/" target="_blank" rel="noopener" data-cms-ai="0">Checkov</a>.</li>

<li>Who manages user and group assignments: The managed application administrator handles authorization to managed applications within an AWS account. It’s recommended to clear