docs: reflect AWS account access manager in Identity Center comparisons - #46
Open
jplock wants to merge 3 commits into
Open
docs: reflect AWS account access manager in Identity Center comparisons#46jplock wants to merge 3 commits into
jplock wants to merge 3 commits into
Conversation
AWS account access manager lets Identity Center assign existing IAM roles (no permission sets) and adds the simplified aws login CLI flow. Update the startups comparison table so both claims stay accurate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015BjoycztFrpDt8gpjUrXLP
Roles assigned through Identity Center's account access manager live in the separate account-access API namespace, so vouch setup aws --discover (SSO portal APIs) surfaces permission-set assignments only. Point readers at role chaining or direct federation for those roles. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015BjoycztFrpDt8gpjUrXLP
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015BjoycztFrpDt8gpjUrXLP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AWS introduced account access manager, an IAM Identity Center capability that assigns existing IAM roles (instead of permission sets) to Identity Center users/groups, with a simplified
aws loginCLI flow and its ownaccount-accessAPI namespace. Three of our pages made claims this makes stale.Changes
content/docs/startups.md— "Why not IAM Identity Center?" table: permission sets are no longer the only assignment model, andaws sso loginis no longer the only CLI flow. Both rows updated; the overall argument (Organizations + Identity Center instance + sync still required, browser SSO, AWS-only) is unchanged.content/docs/aws-multi-account.md— added a callout in the Identity Center section: Vouch's trusted-token-issuer discovery uses the SSO portal APIs (ListAccounts/ListAccountRoles/GetRoleCredentials), sovouch setup aws --discoversurfaces permission-set assignments only — account access manager assignments live in the separateaccount-accessnamespace and are not discovered. Readers are pointed at role chaining or direct OIDC federation for those roles (they are ordinary IAM roles). Verified against the CLI source (crates/vouch-cli/src/integrations/aws/sso_portal.rscalls only the SSO portal APIs). Also a one-line pointer in the page intro.content/compare/_index.md— "Choose IAM Identity Center when" wording generalized from "complex permission sets" to permission sets or centrally assigned IAM roles.Not in scope
CLI support for discovering account access manager entitlements (via
account-access:ListEntitlements) and vending credentials for entitled roles through role chaining is now tracked in vouch-sh/vouch#901. The docs note in this PR is written as a current limitation and should be revised when that lands.🤖 Generated with Claude Code
https://claude.ai/code/session_015BjoycztFrpDt8gpjUrXLP