AWS Account Access

Overview

AWS account access manager assigns your existing IAM roles to users in your IAM Identity Center organization instance. This guide connects it to Britive so those roles become checkout-able profiles.

What you’ll accomplish:

• Enable account access manager on your AWS organization’s management account
• Allow account access manager to assume the IAM roles you want to grant
• Onboard the application in Britive, scan it, and verify a checkout end to end

How It Works

At checkout, Britive creates an entitlement in account access manager binding the user to an account and role. The user then reaches that account through the AWS account access portal. At check-in, Britive deletes the entitlement.

Checkout → account-access:CreateEntitlement → user opens account access portal
        → sts:AssumeRole (account-access.amazonaws.com) → account console or CLI
Check-in → account-access:DeleteEntitlement → access removed

Because the grant is the entitlement rather than a credential, no long-lived keys exist and nothing is issued to the user by Britive.

Before You Begin

• An AWS organization with a management account, and administrator access to it
• An IAM Identity Center organization instance, with users synchronized from your identity source
• A Britive tenant with administrator access
• The Britive integration role already configured in the management account — see Getting Started
• AWS CLI 2.33.29 or later, if you plan to use the CLI steps

Confirm that account access manager is available in your IAM Identity Center primary Region. See AWS prerequisites and considerations.

If your organization filters web traffic — through a corporate VPN, firewall, or secure web gateway — allow the account access manager endpoints before users sign in. See AWS network allowlisting requirements.

Step 1 — Enable account access manager and get the application ARN

Account access manager can only be enabled in the region where IAM Identity Center was first enabled for the organization — its primary region.

From the management account, enable trusted service access for account access manager:

aws organizations enable-aws-service-access \
  --service-principal account-access.amazonaws.com

Then collect the application ARN and the Application URL.

aws account-access list-applications --region <primary-region>

Step 2 — Allow account access manager to assume the role

Add this statement to the trust policy of every IAM role you want to grant through Britive.

{
  "Effect": "Allow",
  "Principal": { "Service": "account-access.amazonaws.com" },
  "Action": ["sts:AssumeRole", "sts:SetContext"],
  "Condition": {
    "StringEquals": {
      "aws:SourceAccount": "<management-account-id>",
      "aws:SourceArn": "<account-access-manager-arn>"
    }
  }
}

Both actions are required. A role missing either one is discovered by the scan but cannot be added to a profile.

Step 3 — Grant the integration role account access permissions

Britive creates and deletes entitlements, so the integration role needs write access to the account-access namespace — not read-only access as with other AWS application types.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DiscoverApplications",
      "Effect": "Allow",
      "Action": "account-access:ListApplications",
      "Resource": "*"
    },
    {
      "Sid": "ManageEntitlements",
      "Effect": "Allow",
      "Action": [
        "account-access:ListEntitlements",
        "account-access:CreateEntitlement",
        "account-access:DeleteEntitlement"
      ],
      "Resource": "arn:aws:account-access:<region>:<management-account-id>:application/<application-id>"
    }
  ]
}

Britive uses ListApplications during Save and Test to confirm the application ARN exists in the configured management account and Region. AWS does not support resource-level scoping for this action, so it requires "Resource": "*".

Attach this alongside the read permissions the integration role already carries for scanning.

Step 4 — Add the application in Britive

In the Britive console, go to System Administration → Tenant Apps → Add Applications and select AWS Account Access. Complete both tabs, then select Save and Test.

Save and Test resolves the application ARN against your account. A failure naming the ARN means the value is wrong or belongs to another account or region.

Step 5 — Scan the organization and its accounts

Step 6 — Create a profile and check out

Create a profile containing a scanned role, add a member, and have that member check it out from My Access.

Verify

aws account-access list-entitlements \
  --application-arn <account-access-manager-arn> \
  --filter '{"principalRole":{"account":"<member-account-id>"}}' \
  --region <primary-region>

Troubleshoot

Next Steps

• Getting Started — the SAML-based AWS application type, and the integration role setup shared with this guide
• AWS account access manager — AWS’s own documentation