Identity Center

​

After this article

​

Capabilities

• Create: with SCIM configured, Lumos creates the user via POST /Users. Without SCIM, it uses the Identity Store CreateUser action. Creation is idempotent: if AWS reports a conflict, Lumos looks up the existing user by username and then by email, links that account, and reports “Account already exists. No create action was needed.”
• Update: profile changes (including the SCIM enterprise attributes listed below) go through a SCIM PATCH, or the Identity Store UpdateUser action when SCIM isn’t configured.
• Deactivate and reactivate: SCIM only. If the account is already in the requested state, the action is a safe no-op.
• Permission sets: assignment and removal run through CreateAccountAssignment and DeleteAccountAssignment, which are asynchronous in AWS. Lumos polls the assignment status with increasing backoff until AWS reports it complete, so most assignments finish within seconds. Removing an assignment that AWS reports as already gone is treated as a successful no-op.
• Groups: Lumos creates or deletes the group membership in the Identity Store. Assigning a group the user already belongs to (for example when an access request is extended) is a safe no-op.

​

Required plan and roles

• AWS permissions: you need elevated AWS permissions for IAM, IAM Identity Center (SSO), and AWS Organizations to complete the setup.
• Identity source: your IAM Identity Center instance must use an External identity provider as its identity source.
• Role permissions (simplest): attach the AWS managed policies AWSSSODirectoryAdministrator and AWSSSOMasterAccountAdministrator to the role Lumos assumes.
• Role permissions (least privilege): attach this custom policy instead:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAccessToIdentityCenter",
      "Effect": "Allow",
      "Action": [
        "identitystore:ListUsers",
        "identitystore:DescribeUser",
        "identitystore:ListGroups",
        "identitystore:DescribeGroup",
        "identitystore:ListGroupMemberships",
        "identitystore:GetGroupMembershipId",
        "identitystore:CreateGroupMembership",
        "identitystore:DeleteGroupMembership",
        "identitystore:CreateUser",
        "identitystore:DeleteUser",
        "organizations:DescribeAccount",
        "organizations:ListAccounts",
        "sso:DescribePermissionSet",
        "sso:ListAccountAssignments",
        "sso:ListAccountsForProvisionedPermissionSet",
        "sso:ListPermissionSetsProvisionedToAccount",
        "sso:ListInstances",
        "sso:ListPermissionSets",
        "sso:DescribeInstance",
        "sso:DescribeAccountAssignmentCreationStatus",
        "sso:DescribeAccountAssignmentDeletionStatus",
        "sso:DeleteAccountAssignment",
        "sso:CreateAccountAssignment",
        "sso:ListAccountAssignmentsForPrincipal"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AccessToSSOProvisionedRoles",
      "Effect": "Allow",
      "Action": [
        "iam:AttachRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:DetachRolePolicy",
        "iam:ListAttachedRolePolicies",
        "iam:GetRole",
        "iam:CreateRole",
        "iam:DeleteRole",
        "iam:PutRolePolicy",
        "iam:UpdateRole",
        "iam:ListRolePolicies",
        "iam:UpdateRoleDescription"
      ],
      "Resource": "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*"
    },
    {
      "Sid": "AccessToSCIMProvider",
      "Effect": "Allow",
      "Action": ["iam:GetSAMLProvider"],
      "Resource": "arn:aws:iam::*:saml-provider/AWSSSO_*_DO_NOT_DELETE"
    }
  ]
}

• Read-only option: for a read-only connection, drop all write actions from the policy above (keep only the List*, Describe*, and Get* actions) and leave the SCIM fields empty in Lumos. The SCIM token grants write access.
• Permission purposes:
  • identitystore:* actions read and manage users and groups in the Identity Store.
  • sso:* actions read permission sets and create or delete account assignments.
  • organizations:* actions map accounts under your organization.
  • The iam:* role actions are scoped to the AWS-reserved roles that Identity Center creates in member accounts when assignments change.

​

Read-only access vs provisioning

​

Instructions

1. Open the IAM Identity Center console → Settings and confirm Identity source shows External identity provider. If not, follow AWS’s instructions to change the identity source.
2. Click Actions → Manage Provisioning to collect two SCIM values:
   • Copy the SCIM endpoint. This is the Tenant ID value for Lumos, and you can enter either the full SCIM endpoint URL or just the alphanumeric tenant ID from it. You can also find it under Settings → Automatic provisioning → SCIM endpoint.
   • Click Generate token and copy it. This is the API Key value for Lumos. You can also generate it under Settings → Automatic provisioning → Access tokens. SCIM is optional, but it’s required for user activation and deactivation and for enterprise attributes. Skip these two values for read-only.
3. Back on Settings, copy the IAM Identity Center ARN (format arn:aws:sso:::instance/ins-{id}).
4. Note your AWS Region (shown in the top-right corner of the console, for example us-west-2).

• IAM Console → Roles → Create Role → Another AWS account → Account ID 349123981986.
• Enable Require external ID and enter a secure value.
• Attach the managed policies or the least-privilege custom policy from above.
• Edit the trust relationship so the Principal is arn:aws:iam::349123981986:user/global-service-account.
• The connector uses the default 1 hour session duration. Pre-July-2025 connections required the max session duration set to 12 hours.

   data "aws_iam_policy" "AWSSSODirectoryAdministrator" {
     arn = "arn:aws:iam::aws:policy/AWSSSODirectoryAdministrator"
   }

   data "aws_iam_policy" "AWSSSOMasterAccountAdministrator" {
     arn = "arn:aws:iam::aws:policy/AWSSSOMasterAccountAdministrator"
   }

   resource "aws_iam_role" "lumos_identity_center_role" {
     name = "LumosIdentityCenterIntegrationRole"
     max_session_duration = 43200

     assume_role_policy = jsonencode({
       Version = "2012-10-17",
       Statement = [{
         Action = "sts:AssumeRole",
         Effect = "Allow",
         Principal = {
           AWS = "arn:aws:iam::349123981986:user/global-service-account"
         },
         Condition = {
           StringEquals = {
             "sts:ExternalId" = "CHOOSE_YOUR_EXTERNAL_ID"
           }
         }
       }]
     })
   }

   resource "aws_iam_role_policy_attachment" "directory_admin" {
     role       = aws_iam_role.lumos_identity_center_role.name
     policy_arn = data.aws_iam_policy.AWSSSODirectoryAdministrator.arn
   }

   resource "aws_iam_role_policy_attachment" "master_admin" {
     role       = aws_iam_role.lumos_identity_center_role.name
     policy_arn = data.aws_iam_policy.AWSSSOMasterAccountAdministrator.arn
   }

6. Copy the role ARN and your external ID.

1. Find the AWS IAM Identity Center card in your Lumos integrations. Reconnect an existing card or add a new one.
2. Enter the Region, IAM Identity Center ARN, Service Role ARN, External ID, and, optionally for provisioning, the Tenant ID (SCIM endpoint) and API Key (SCIM token).
3. Click Connect.

​

API Endpoints Used

​

Troubleshooting

• Drive account creation from the AWS IAM Identity Center app itself. The existing-account check then looks at Identity Center, where Lumos already syncs accounts, so it skips creation for existing users and still creates accounts for new ones.
• Contact Lumos support about enabling handling that recognizes the existing Identity Center account and continues the workflow instead of raising a manual task. This requires SCIM to be configured on the connection and the existing Identity Center account to be matched to the user’s Lumos identity.

​

Switching SCIM provisioning from your IdP to Lumos

1. Disable SCIM provisioning in your IdP first. This stops the IdP from pushing updates or treating Lumos-managed users as out of sync.
2. Don’t delete users in AWS Identity Center. Existing users can stay in place, and Lumos maps and manages them going forward.
3. Generate a new SCIM access token in AWS Identity Center: Settings → Manage Provisioning → Generate token.
4. Connect Lumos using the SCIM endpoint and token. Lumos requires both the SCIM tenant identifier and the SCIM token for provisioning operations.
5. Validate lifecycle management in a staged way. Start with a small pilot group of users to confirm behavior before expanding coverage.