Connecting AWS IAM Identity Center

Lumos integrates with AWS IAM Identity Center to help you conduct access reviews across your AWS accounts. We surface IAM Identity Center users, the accounts they can access, and their permission sets. If SCIM is enabled, Lumos also supports automated user provisioning, otherwise provisioning and deprovisioning will occur in AWS Identity Store.

Prerequisites

You must have elevated AWS permissions for:

• IAM

• IAM Identity Center (SSO)

• AWS Organizations

Connection Instructions

Step 1: Enable SCIM and Collect Required Values

1. Go to the IAM Identity Center console → Settings.

2. Confirm Identity source shows as External identity provider.

   • If not, follow these instructions.

3. Click Actions → Manage Provisioning:

   • Copy the SCIM endpoint value to the Tenant ID field (e.g., Nvdk4lx216-7d1e-4759-f84a-047fj48sd370).

   • Click Generate token → copy to the API Key field.

4. Back on the Settings page:

   • Copy the IAM Identity Center ARN.

5. Find your AWS Region (top-right corner near your email, e.g., us-west-2).

Step 2: Create IAM Role for Lumos

You can create the role via AWS Console or Terraform.

Option A: AWS Console

1. IAM Console → Roles → Create Role.

2. Select Another AWS account → enter Account ID 349123981986.

   • Enable Require external ID and enter a secure value.

3. Add permissions:

   • For simplest management, attach:

     • AWSSSODirectoryAdministrator

     • AWSSSOMasterAccountAdministrator

   • For least privilege, use this custom policy:

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "AllowAccessToIdentityCenter",
        "Effect": "Allow",
        "Action": [
          "identitystore:ListUsers",
          "identitystore:DescribeUser",
          "identitystore:ListGroups",
          "identitystore:DescribeGroup",
          "identitystore:ListGroupMemberships",
          "identitystore:GetGroupMembershipId",
          "identitystore:CreateGroupMembership",
          "identitystore:DeleteGroupMembership",
          "identitystore:CreateUser",
          "identitystore:DeleteUser",
          "organizations:DescribeAccount",
          "organizations:ListAccounts",
          "sso:DescribePermissionSet",
          "sso:ListAccountAssignments",
          "sso:ListAccountsForProvisionedPermissionSet",
          "sso:ListPermissionSetsProvisionedToAccount",
          "sso:ListInstances",
          "sso:ListPermissionSets",
          "sso:DescribeInstance",
          "sso:DescribeAccountAssignmentDeletionStatus",
          "sso:DescribeAccountAssignmentCreationStatus",
          "sso:DeleteAccountAssignment",
          "sso:CreateAccountAssignment",
          "sso:ListAccountAssignmentsForPrincipal"
        ],
        "Resource": "*"
      },
      {
        "Sid": "AccessToSSOProvisionedRoles",
        "Effect": "Allow",
        "Action": [
          "iam:AttachRolePolicy",
          "iam:DeleteRolePolicy",
          "iam:DetachRolePolicy",
          "iam:ListAttachedRolePolicies",
          "iam:GetRole",
          "iam:CreateRole",
          "iam:DeleteRole",
          "iam:PutRolePolicy",
          "iam:UpdateRole",
          "iam:ListRolePolicies",
          "iam:UpdateRoleDescription"
        ],
        "Resource": "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*"
      },
      {
        "Sid": "AccessToSCIMProvider",
        "Effect": "Allow",
        "Action": [
          "iam:GetSAMLProvider"
        ],
        "Resource": "arn:aws:iam::*:saml-provider/AWSSSO_*_DO_NOT_DELETE"
      }
    ]
  }

4. For Read-Only, use this custom policy. Ensure that SCIM fields are left empty, as those grant write actions.

   {
       "Version": "2012-10-17",
       "Statement": [
         {
           "Sid": "AllowAccessToIdentityCenter",
           "Effect": "Allow",
           "Action": [
             "identitystore:ListUsers",
             "identitystore:DescribeUser",
             "identitystore:ListGroups",
             "identitystore:DescribeGroup",
             "identitystore:ListGroupMemberships",
             "identitystore:GetGroupMembershipId",
             "organizations:DescribeAccount",
             "organizations:ListAccounts",
             "sso:DescribePermissionSet",
             "sso:ListAccountAssignments",
             "sso:ListAccountsForProvisionedPermissionSet",
             "sso:ListPermissionSetsProvisionedToAccount",
             "sso:ListInstances",
             "sso:ListPermissionSets",
             "sso:DescribeInstance",
             "sso:DescribeAccountAssignmentDeletionStatus",
             "sso:DescribeAccountAssignmentCreationStatus",
             "sso:ListAccountAssignmentsForPrincipal"
           ],
           "Resource": "*"
         },
         {
           "Sid": "AccessToSSOProvisionedRoles",
           "Effect": "Allow",
           "Action": [
             "iam:ListAttachedRolePolicies",
             "iam:GetRole",
             "iam:ListRolePolicies",
           ],
           "Resource": "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*"
         },
         {
           "Sid": "AccessToSCIMProvider",
           "Effect": "Allow",
           "Action": [
             "iam:GetSAMLProvider"
           ],
           "Resource": "arn:aws:iam::*:saml-provider/AWSSSO_*_DO_NOT_DELETE"
         }
       ]
     }
   

5. Edit the trust relationship:

   • Set Principal to: arn:aws:iam::349123981986:user/global-service-account

6. The connector will use the default 1 hour session duration.

7. Copy the role ARN and store it securely.

8. [Optional] Provide either the full SCIM endpoint URL or just the tenant ID used for SCIM API calls. It can be found in the IAM Identity Center console under 'Settings' - 'Automatic provisioning' - SCIM endpoint. You can also get there through 'Settings' - 'Identity source' tab - Actions - Manage provisioning - SCIM endpoint.You can enter the full URL (e.g., 'https://scim.us-east-1.amazonaws.com/xxxxxxxxxxx-xxxx-xxxx-xxxx-xxxx/scim/v2') or just copy the alphanumeric code from the URL (e.g., 'xxxxxxxxxxx-xxxx-xxxx-xxxx-xxxx').

9. [Optional] Provide the SCIM API token: Authentication token for SCIM API interactions with IAM Identity Center. Generate this token in the IAM Identity Center console under 'Settings' - 'Automatic provisioning' - 'Access tokens'. Treat as a sensitive credential with appropriate security measures.

10. Enter all fields into Lumos.

11. Click Connect.

Option B: Terraform

data "aws_iam_policy" "AWSSSODirectoryAdministrator" {
  arn = "arn:aws:iam::aws:policy/AWSSSODirectoryAdministrator"
}

data "aws_iam_policy" "AWSSSOMasterAccountAdministrator" {
  arn = "arn:aws:iam::aws:policy/AWSSSOMasterAccountAdministrator"
}

resource "aws_iam_role" "lumos_identity_center_role" {
  name = "LumosIdentityCenterIntegrationRole"
  max_session_duration = 43200

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [{
      Action = "sts:AssumeRole",
      Effect = "Allow",
      Principal = {
        AWS = "arn:aws:iam::349123981986:user/global-service-account"
      },
      Condition = {
        StringEquals = {
          "sts:ExternalId" = "CHOOSE_YOUR_EXTERNAL_ID"
        }
      }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "directory_admin" {
  role       = aws_iam_role.lumos_identity_center_role.name
  policy_arn = data.aws_iam_policy.AWSSSODirectoryAdministrator.arn
}

resource "aws_iam_role_policy_attachment" "master_admin" {
  role       = aws_iam_role.lumos_identity_center_role.name
  policy_arn = data.aws_iam_policy.AWSSSOMasterAccountAdministrator.arn
}

Provisioning Capabilities

API Operations Used

This integration uses a combination of AWS SDK (boto3) operations and SCIM HTTP endpoints to interact with AWS IAM Identity Center.

AWS SDK Operations (boto3)

The connector uses multiple AWS services through the boto3 SDK.

AWS STS (Security Token Service)

AWS Identity Store

AWS SSO Admin

AWS Organizations

SCIM HTTP Endpoints

Base URL Format: https://scim.{region}.amazonaws.com/{tenant_id}/scim/v2/

SCIM endpoints are optional but required for user activation/deactivation and custom enterprise attributes.

SCIM Enterprise Extension Attributes Supported:
- employeeNumber
- costCenter
- organization
- division
- department
- manager (reference to another user ID)

Authentication: SCIM endpoints use Bearer token authentication configured during SCIM setup in IAM Identity Center.

Important Notes

AWS Region: All operations are performed in the configured AWS region specified during setup.

Authentication Flow:
1. Initial AWS credentials authenticate to STS
2. STS AssumeRole creates temporary credentials (uses default 1 hour session duration)
3. Temporary credentials used for Identity Store, SSO Admin, and Organizations operations
4. SCIM endpoints use separate Bearer token authentication

Asynchronous Operations:
- Account assignment creation and deletion are asynchronous
- Waits 60 seconds, then checks the operation status once. Operations may complete successfully even if the check finds them still in progress.
- Operations may complete successfully even if polling times out

Parallel Processing:
- The connector uses ThreadPoolExecutor for parallel boto3 calls
- Group memberships and account assignments are fetched in parallel (max 10 workers)
- This significantly improves sync performance for large organizations

Documentation Links:
- AWS Identity Store API Reference
- AWS SSO Admin API Reference
- AWS Organizations API Reference
- AWS STS API Reference
- AWS SCIM Protocol Documentation

Troubleshooting

"Access Denied" when assuming role

Solutions:
- Verify Service Role ARN is correct
- Check External ID matches trust policy exactly
- Confirm Lumos account (349123981986) is trusted
- Verify role exists and is not deleted

"Instance not found" error

What this means:
Identity Center ARN is incorrect or instance doesn't exist.

Solution:
- Verify Identity Center is enabled
- Check ARN format: arn:aws:sso:::instance/ins-{id}
- Ensure ARN copied from Settings → Instance ARN

SCIM operations failing

Possible causes:
- SCIM not configured
- SCIM token expired or invalid
- SCIM identifier incorrect

Solution:
- Verify SCIM is enabled in Identity Center settings
- Regenerate SCIM access token
- Check SCIM identifier matches tenant ID from endpoint URL
- Test SCIM endpoint accessibility

Permission set assignment timeout

What this means:
Account assignment operation didn't complete within 60 seconds.

Solution:
- This is normal for first-time assignments
- Check AWS console for assignment status
- Assignment may complete successfully despite timeout
- Retry if assignment didn't succeed

"Insufficient permissions" errors

What this means:
Service role missing required permissions.

Solution:
- Review custom policy includes all required permissions
- Check Identity Store permissions
- Verify SSO Admin permissions
- Confirm Organizations read access

FAQ: