import { BlockInfoCard } from "@/components/ui/block-info-card"

{/* MANUAL-CONTENT-START:intro */} AWS IAM Identity Center (formerly AWS Single Sign-On) is the recommended service for managing workforce access to multiple AWS accounts and applications. It provides a central place to assign users and groups temporary, permission-scoped access to AWS accounts using permission sets — without creating long-lived IAM credentials.

With AWS IAM Identity Center, you can:

• Provision account assignments: Grant a user or group access to a specific AWS account with a specific permission set — the core primitive of temporary elevated access
• Revoke access on demand: Delete account assignments to immediately remove elevated permissions when they are no longer needed
• Look up users by email: Resolve a federated identity (email address) to an Identity Store user ID for programmatic access provisioning
• List permission sets: Enumerate the available permission sets (e.g., ReadOnly, PowerUser, AdministratorAccess) defined in your Identity Center instance
• Monitor assignment status: Poll the provisioning status of create/delete operations, which are asynchronous in AWS
• List accounts in your organization: Enumerate all AWS accounts in your AWS Organizations structure to populate access request dropdowns
• Manage groups: List groups and resolve group IDs by display name for group-based access grants

In Sim, the AWS Identity Center integration is designed to power TEAM (Temporary Elevated Access Management) workflows — automated pipelines where users request elevated access, approvers approve or deny it, access is provisioned with a time limit, and auto-revocation removes it when the window expires. This replaces manual console-based access management with auditable, agent-driven workflows that integrate with Slack, email, ticketing systems, and CloudTrail for full traceability. {/* MANUAL-CONTENT-END */}

Provision and revoke temporary access to AWS accounts via IAM Identity Center (SSO). Assign permission sets to users or groups, look up users by email, and list accounts and permission sets for access request workflows.

List all AWS IAM Identity Center instances in your account

List all AWS accounts in your organization

Retrieve details about a specific AWS account by its ID

List all permission sets defined in an IAM Identity Center instance

Look up a user in the Identity Store by email address

Look up a group in the Identity Store by display name

List all groups in the Identity Store

Grant a user or group access to an AWS account via a permission set (temporary elevated access)

Revoke a user or group access to an AWS account by removing a permission set assignment

Check the provisioning status of an account assignment creation request

Check the deprovisioning status of an account assignment deletion request

List all account assignments for a specific user or group across all accounts