AWS Identity Center

List Instances

List all AWS IAM Identity Center instances in your account

List Accounts

List all AWS accounts in your organization

Describe Account

Retrieve details about a specific AWS account by its ID

List Permission Sets

List all permission sets defined in an IAM Identity Center instance

Get User

Look up a user in the Identity Store by email address

Describe User

Resolve an Identity Store user ID to the user behind it. Use to turn the principalId on an account assignment into a name and email.

Get Group

Look up a group in the Identity Store by display name

Describe Group

Resolve an Identity Store group ID to the group behind it. Use to turn the principalId on an account assignment into a group name.

List Groups

List all groups in the Identity Store

List Group Memberships

List the users who belong to an Identity Store group

Create Account Assignment

Grant a user or group access to an AWS account via a permission set (temporary elevated access)

Delete Account Assignment

Revoke a user or group access to an AWS account by removing a permission set assignment

Check Assignment Status

Check the provisioning status of an account assignment creation request

Check Assignment Deletion Status

Check the deprovisioning status of an account assignment deletion request

List Account Assignments For Principal

List every account and permission set a specific user or group is assigned. Use List Assignments For Account to go the other way, from an account to its principals.

List Assignments For Account

List every principal assigned a specific permission set on a specific AWS account. Use for per-account access reviews.