AWS announced Account Access Manager (AAM) on November 5, 2026. The IAM service lets organizations assign existing roles in individual AWS accounts to users and groups in an organization instance of IAM Identity Center. AWS says AAM can also work alongside IAM Identity Center permission sets. AWS’s announcement describes the service, setup requirements, access routes and regional terms.
How AAM connects a workforce identity to an existing role
An AAM entitlement links an IAM Identity Center user or group, an AWS account, and an IAM role ARN. Administrators can create entitlements in the console, through the API, or with the CLI. Assignments can use groups; to give the same role to multiple individual users, administrators must create separate assignments unless they automate that work through an API, SDK or CLI.
AAM centralizes assignment while leaving organizations able to use existing account-level roles. That makes it an option for teams whose roles differ by account, as well as a service that AWS says can coexist with permission sets. The role’s trust policy must allow the AAM service principal, account-access.amazonaws.com. AWS’s example also limits trust to the source account and AAM application ARN.
The console view shows the direct-assignment area and its “Assign new access” control. It also indicates that a user may receive account access through group membership.
What administrators need before assigning roles
AWS lists an organization instance of IAM Identity Center, workforce users or groups, eligible IAM roles, and enablement from the organization’s management account as prerequisites. Administrators need to update each eligible role’s trust policy to allow AAM. AWS recommends source-account and application-ARN conditions in its example.
The console can find users, groups and accounts, but it cannot discover IAM roles across accounts. Administrators need to know the role names, and only roles whose trust policies permit AAM are eligible. If an organization filters AWS traffic through a firewall or secure web gateway, AWS says to allow the AAM portal, API, runtime and console endpoints. Those endpoints are dual-stack; AWS says it has no IPv4-only endpoints. Organizations with a customer-managed KMS key should also check its IAM Identity Center key policy, particularly when the instance is replicated to additional Regions.
Before creating assignments, identify the role in each account and make sure its trust policy allows AAM.
How users open an assigned role
Users can open assigned roles from the AAM portal or from the Applications tab in the IAM Identity Center access portal. For command-line access, AWS specifies aws login with AWS CLI version 2.36.0 or later. AWS says IAM Identity Center-specific commands such as aws sso configure do not work with AAM assignments.
A session follows the maximum duration configured on its underlying IAM role, up to 12 hours. For attribute-based access control, AWS describes using role tags and, when configured, session tags passed from identity-provider SAML claims. If downstream policies rely on those session tags, AWS says the role needs sts:TagSession; without it, role assumption can still succeed, but the session tags are suppressed.
AWS says AAM has no additional cost and is enabled by default in Commercial Regions except opt-in Commercial Regions. Its stated exclusions also include GovCloud (US), China and other non-commercial Regions.
Earlier AAM activity and Lumos’s integration
AWS published an AAM enablement tutorial on August 17, 2026. A console screenshot in AWS’s November announcement shows one AAM instance with an enabled-on date of September 23, 2026. Those dates belong to the tutorial and that instance, respectively.
In a post published October 14, 2026, Lumos said its platform reads AAM assignments into an identity graph for human and machine identities and flags issues for review. Lumos described provisioning through AAM and support for identity providers beyond Microsoft Entra ID as future plans in that post. Lumos’s account of its integration distinguishes assignment visibility from the provisioning it said it planned.
