AWS IAM Identity Center (formerly AWS Single Sign-On) is the recommended service for managing workforce access to AWS accounts and applications centrally. It provides a unified user directory, SSO access, and detailed user activity across the AWS organization. For more information, refer to the AWS IAM Identity Center documentation.
Integration Method: API
Tables: User Inventory Info (5003), Account Change (3001)
This integration supports the following events.
Event | Description |
|---|---|
Users | Retrieve user inventory including active and deprovisioned identities managed through AWS IAM Identity Center. |
Prerequisites
An AWS account with IAM Identity Center enabled.
An IAM user or role with
sso:ListUsersandidentitystore:ListUserspermissions.AWS Access Key ID and Secret Access Key (or an IAM role with equivalent permissions).
Access to the DataBee console.
Configuration Overview
Create or identify an IAM user or role with the required Identity Center read permissions.
Generate Access Key credentials for that user.
Add the AWS Identity Center data feed in the DataBee console with the below parameters.
DataBee Parameter | AWS Parameter |
|---|---|
Access Key ID | IAM Access Key ID |
Secret Access Key | IAM Secret Access Key |
Region | AWS Region where Identity Center is configured (e.g. |
Identity Store ID | The Identity Store ID from your IAM Identity Center instance |
AWS Configuration
Sign in to the AWS Management Console.
Navigate to IAM > Users and select or create the user that DataBee will use for API access.
Attach an inline or managed policy granting at minimum:
json { "Effect": "Allow", "Action": [ "sso:ListUsers", "identitystore:ListUsers", "identitystore:DescribeUser" ], "Resource": "*" }
Under the user's Security credentials tab, click Create access key.
Select Application running outside AWS and click Next.
Copy the Access Key ID and Secret Access Key for use in the DataBee configuration.
Note:
The Secret Access Key is shown only once. Store it securely before closing this dialog.
To find your Identity Store ID, navigate to IAM Identity Center in the AWS Console. The Identity Store ID is displayed on the Settings page.
DataBee Configuration
Log in to the DataBee console, navigate to Data > Data Feeds, and click Add New Data Feed.
Search for AWS Identity Center and select it.
Select API Ingest as the collection method.
Enter feed contact information and click Next.
In the configuration section, enter the following:
Access Key ID: Paste the IAM Access Key ID.
Secret Access Key: Paste the IAM Secret Access Key.
Region: Enter the AWS region (for example,
us-east-1).Identity Store ID: Enter the Identity Store ID from your IAM Identity Center instance.
Click Test Connection to verify your credentials. A Connection successful! message confirms that DataBee can reach the AWS Identity Center API.
Click Submit.
Troubleshooting Tips
Ensure the IAM user has both
sso:ListUsersandidentitystore:ListUserspermissions — both are required.Verify the Region and Identity Store ID match the Identity Center instance you intend to connect.
If the connection test fails, confirm the Access Key is active and has not been rotated.