Scale your team's use of AWS IAM account access manager with Pulumi

AWS IAM Account Access Manager, launched in September 2026, enables organizations to centrally assign their existing account-specific IAM roles to IAM Identity Center users and groups, combining single sign-on and centralized visibility with flexible role policies, tags, paths, and trust conditions. Pulumi now supports AAM through its AWS and AWS Native providers, allowing teams to define AAM applications, IAM roles, and group-to-role entitlements as infrastructure as code in languages including TypeScript, Python, Go, Java, C#, HCL, and YAML. This approach links role creation and access assignments in the same deployment lifecycle, supports code review, policy enforcement, auditability, and scalable generation of entitlements across many accounts. The implementation requires an organization IAM Identity Center instance and trusted AWS Organizations access, then involves creating an AAM application, configuring roles to trust the AAM service with appropriately scoped conditions, and assigning those roles to Identity Center groups. A financial-services example describes a digital bank using this model to migrate workforce access from fragmented per-account IAM roles to centralized IAM Identity Center access while preserving account-specific role customization and its existing Pulumi-based deployment workflows.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.