Assign and remove access

Assign user or group access to an AWS account

You can assign a user or group access to an AWS account by creating an assignment between the user or group, the account, and the IAM role that the user or group can assume in the account. Thus, a single assignment is a triplet consisting of the user or group ID, the account ID, and the IAM role ARN.

If you want to perform bulk assignments such as assigning the same role to a number of users and groups, you must create each assignment individually. You can script this procedure using the account access API, and the AWS SDK/CLI.

Console

The console provides a few different ways to assign new access depending on whether you want to first identify the account, the user, or the group.

Note

The account access manager console provides a search capability for users, groups, and accounts. To identify the role you want to assign, you must find its name (or ARN) beforehand. The account access manager console cannot detect IAM roles in AWS accounts.

For all procedures in this section, sign in to the management account (or delegated admin account), select the Region where account access manager is enabled, and navigate to Account access manager in the IAM console.

Accounts tab

To assign user or group access from the Accounts tab

1. Choose the Accounts tab.

2. If you already know the account ID, choose Assign new access. On the Assign account access page, look up the desired user or group, enter the account ID, and IAM role name, and then choose Assign access.

3. If you need to first find the account, you can search for the desired AWS account by its name, ID, or email address. Alternatively, you can review the organizational structure or account list to find the relevant AWS account. Choose the radio button in front of the account and then Assign new access. On the Assign account access page, look up the desired user or group, enter the IAM role name, and then choose Assign access.

4. The organizational structure or account list lets you choose an account to view account details and account access assignments. You can choose Assign new access from there too.

Users tab

To assign user access from the Users tab

1. Choose the Users tab.

2. You can search users by username and display name or find them in the displayed user list.

3. Choose the user you want to assign new access to.

4. The next page shows the user attributes, account assignments, and group memberships.

5. Choose Assign new access.

6. On the Assign account access page, enter the account ID and IAM role name, and then choose Assign access.

Groups tab

To assign group access from the Groups tab

1. In the navigation pane, choose Account access manager.

2. Choose the Groups tab.

3. You can search groups by group name or find them in the displayed group list.

4. Choose the group you want to assign new access to.

5. The next page shows the group attributes, account assignments, and user members.

6. Choose Assign new access.

7. On the Assign account access page, enter the account ID and IAM role name, and then choose Assign access.

AWS CLI

The following AWS CLI command can be used to create an account assignment for a user:

aws account-access create-entitlement \
  --region <Region> \
  --application-arn "<Account_access_manager_ARN>" \
  --entitlement '{
    "principalRole": {
      "principal": {
        "identityCenter": {
          "userId": "<Identity_Center_User_ID>"
        }
      },
      "roleArn": "arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>"
    }
  }'

The following AWS CLI command can be used to create an account assignment for a group:

aws account-access create-entitlement \
  --region <Region> \
  --application-arn "<Account_access_manager_ARN>" \
  --entitlement '{
    "principalRole": {
      "principal": {
        "identityCenter": {
          "groupId": "<IDC_GROUP_ID>"
        }
      },
      "roleArn": "arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>"
    }
  }'

Remove user or group access to an AWS account

You can find the assignment to remove in several ways.

Console

For all procedures in this section, sign in to the management account (or delegated admin account), select the Region where account access manager is enabled, and navigate to Account access manager in the IAM console.

Accounts tab

To remove user or group access from the Accounts tab

1. Choose the Accounts tab.

2. Find the relevant account and choose its name.

3. In the Account access assignments section, choose the user or group you want to remove access for, and choose Unassign.

4. In the modal, choose Unassign to confirm.

Users tab

To remove user access from the Users tab

1. Choose the Users tab.

2. Choose the user you want to remove access for.

3. In the Account access assignments section, choose the account you want to remove access for, and choose Unassign.

4. In the modal, choose Unassign to confirm.

AWS CLI

To remove access with the CLI, you first need to find the account assignment (entitlement) and then use its ID in the following command. You can see later in this topic how to search for account assignments for a specific account, user, group, or role. The CLI refers to assignments as entitlements.

aws account-access delete-entitlement \
    --region <Region> \
    --application-arn "<Account_access_manager_ARN>" \
    --entitlement-id "<ENTITLEMENT_ID>"