AWS adds centralized assignment of existing IAM roles to workforce users

AWS has introduced account access manager, which lets administrators centrally assign existing AWS account roles to workforce users and groups through IAM Identity Center. AWS says the feature preserves custom role permissions and trust policies while carrying individual user identity into shared role sessions, allowing actions to be attributed to specific people. Administrators can manage assignments through the console, APIs and infrastructure automation tools. The feature is available at no additional cost in Commercial Regions, excluding opt-in Regions; GovCloud, China and other non-commercial Regions are excluded. Adoption requires an organization instance of IAM Identity Center and updates to each eligible role's trust policy.