ST-2026-099 · Authentication & identity
AWS IAM Identity Center enables programmatic account access for customer-managed applications
IAM Identity Center can now exchange an external identity-provider token so an enabled customer-managed application can list a user’s assigned AWS accounts and roles and retrieve temporary role credentials without a second sign-in.
Previous state
Users of customer-managed applications that authenticated through an external identity provider had to authenticate again before the application could access their assigned AWS accounts and roles.
Current state
For an enabled customer-managed application, IAM Identity Center can exchange the external identity provider’s signed JWT for an IAM Identity Center token. The application can then call ListAccounts, ListAccountRoles and GetRoleCredentials to discover the user’s assignments and retrieve temporary role credentials without another sign-in.
Affected users
Who needs to care
Backend-based customer-managed applications configured with a trusted token issuer in an organization instance of IAM Identity Center, their application builders, and management-account or delegated administrators who govern access to users’ assigned AWS accounts and roles.
Required response
What to do
Have a management-account or delegated IAM Identity Center administrator explicitly enable the sso:account:access scope for each eligible application; keep exchanged tokens and credentials on the backend; then test CreateTokenWithIAM and the account, role and temporary-credential portal API calls.
Evidence boundary
What the source does not prove
The feature is limited to organization instances and supported backend applications; browser-only public clients are not supported. Enabling sso:account:access exposes every account and role assigned to the authenticated user to that application and cannot be narrowed to selected accounts or roles.
Lifecycle history
Dated event sequence
- Programmatic account access launched
AWS enabled explicitly authorized customer-managed applications to exchange trusted external identity tokens, discover users’ assigned accounts and roles, and retrieve temporary credentials without a separate authentication flow.
Evidence ledger
First-party sources
- 01Amazon Web Services — IAM Identity Center now enables programmatic AWS account access for customer managed applications
Official AWS launch announcement · 2026-06-30
Open official source ↗ - 02Amazon Web Services — Enable AWS account access for customer managed applications
Official AWS IAM Identity Center documentation · 2026-09-03
Open official source ↗