# 1.21 Ensure IAM Users Are Managed Centrally via Identity Federation or AWS Organizations in Multi-Account Environments (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233100-1-21-ensure-iam-users-are-managed-centrally-via-identity-federation-or-aws-organizations-in-multi-acc - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 1](https://support.icompaas.com/support/solutions/folders/62000169194) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 2** ## **Description:** For multi-account AWS environments, IAM users should be centrally managed either through: 1. Identity Federation (e.g., AWS IAM Identity Center, Okta, Microsoft Entra ID, or custom SAML providers). 2. AWS Organizations (using centralized IAM roles instead of standalone IAM users in child accounts). ## Rationale: - Reduces IAM complexity, making user access management easier. - Improves security by preventing duplicate user accounts across AWS accounts. - Simplifies auditing and compliance by centralizing IAM activity logs. - Aligns with best practices from CIS, NIST, and ISO 27001 for secure identity management. ##  Impact: - Eliminating standalone IAM users in AWS accounts may disrupt access if not properly planned. - Requires integration with an external identity provider (IdP) for single sign-on (SSO). - AWS Organizations must be properly set up to prevent IAM user sprawl. ## Default Value: By default: - AWS does not enforce centralized IAM user management. - AWS accounts can create individual IAM users, leading to fragmented identity management. ## Pre-Requisites: 1. IAM Administrator or AWS Organizations Admin Access - Permissions: iam:ListUsers, organizations:DescribeOrganization, sso:GetApplicationAccess 2. AWS Organizations Setup - Ensure your AWS accounts are linked under a master (management) account. 3. Identity Provider (IdP) Integration (Optional) - Supported providers: AWS IAM Identity Center, Okta, Microsoft Entra ID (Azure AD), Google Workspace, Ping Identity, etc. 4. AWS IAM Identity Center Enabled (for role-based access across accounts). ## Remediation: ### Test Plan: ## Using AWS console 1. Login to AWS Console as an IAM Administrator. 2. Open AWS Organizations Console → Verify that all accounts are linked.                      ![](https://support.icompaas.com/assets/kb/371b60afaf5db905.png) 3. Ensure IAM policies restrict IAM user creation in child account ## Using  Identity Federation (SSO) 1. Login to AWS Console as the Identity Federation Master Account. 2. Navigate to IAM Console → Click Identity Providers.                             ![](https://support.icompaas.com/assets/kb/57295200a3cd0e07.png) 3. Verify the IdP Configuration (SAML, OIDC, or AWS IAM Identity Center). 4. Ensure no IAM users exist in child accounts. ## Using AWS Command Line  - Check for IAM Users in AWS Accounts : List all IAM users in the AWS account: aws iam list-users --query 'Users\[\*\].UserName' --output table - If any individual IAM users exist, they must be migrated to IAM roles or SSO access. - Check for AWS Organizations Status : Check if AWS Organizations is enabled: aws organizations describe-organization - If AWS Organizations is not enabled, IAM users must be managed per account. - Check If IAM Identity Center Is Enabled: Verify if IAM Identity Center (AWS SSO) is active: aws sso-admin list-instances - If IAM Identity Center is not listed, configure it for centralized IAM user access. ## Implementation Steps: Step 1: Enable AWS Organizations for Centralized IAM Management 1. Login to AWS Console as an AWS Organizations Administrator.                         ![](https://support.icompaas.com/assets/kb/c5e301d7af6dbbb1.png) 2. Open AWS Organizations Console → Click Enable AWS Organizations. 3. Add all AWS accounts to the Organization. Step 2: Enable IAM Identity Center (AWS SSO) for Centralized Login 1. Open IAM Console → Click IAM Identity Center.                             ![](https://support.icompaas.com/assets/kb/356c6a091f96a808.png) 2. Click Enable IAM Identity Center.                             ![](https://support.icompaas.com/assets/kb/ed69b84a31abb1b0.png) 3. Integrate with an external identity provider (IdP) (Okta, Entra ID, etc.). 4. Create permission sets and assign IAM roles for AWS accounts. Step 3: Remove IAM Users from AWS Accounts 1. Identify IAM users that are not service accounts. 2. Migrate users to IAM roles or AWS SSO. Delete unnecessary IAM users: aws iam delete-user --user-name Ensure IAM policies prevent new IAM users:  { "Effect": "Deny", "Action": "iam:CreateUser", "Resource": "\*" } **Backout Plan:** If IAM users were mistakenly deleted: Recreate the user in IAM: aws iam create-user --user-name 1. Manually restore policies for deleted users. 2. Ensure AWS Organizations and Identity Federation configurations are working before enforcing policies. ## References: - AWS Organizations Best Practices: [AWS Docs](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_best-practices.html) - AWS IAM Identity Center Setup: [AWS Docs](https://docs.aws.amazon.com/singlesignon/latest/userguide/getting-started.html) - Enforcing IAM Identity Federation: [AWS Security Blog](https://aws.amazon.com/blogs/security/enabling-aws-single-sign-on/) ## CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

5.6

Centralize account management through a directory or identity service.

CIS v7

16.2

Configure centralized points of authentication for all accounts.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.