Understanding IAM Identity Center Instance Types When Integrating with Amazon Managed Grafana

IAM Identity Center Instance Types

IAM Identity Center has two instance types:

The two instance types have independent Identity Stores. Users and groups created in one instance are not visible to the other.

Why AMG Does Not Support Account Instances

According to AWS documentation, Amazon Managed Grafana integrates exclusively with the Organization instance of IAM Identity Center. Account instances are not supported.

When you select IAM Identity Center authentication during workspace creation, AMG automatically references the Organization instance associated with the AWS Organization that the account belongs to. Even if a separate Account instance is enabled in the member account, AMG ignores it and uses only the Organization instance.

Typical Scenario Where This Problem Occurs

1. You create an AMG workspace in a member account and enable IAM Identity Center authentication.
2. You directly enable IAM Identity Center in the same member account, creating an Account instance.
3. You create users and groups in the Account instance, then attempt to assign them in the AMG workspace.
4. Users cannot be found, or group assignment fails with a 404 error.

Root cause: AMG queries the Organization instance's Identity Store, but the users and groups exist only in the Account instance's Identity Store.

Resolution

Option 1: Create users and groups in the Organization instance (recommended)

User and group management in the Organization instance requires access to the management account or an IAM Identity Center delegated administrator account. You will need to coordinate with whoever owns that account.

Steps:

1. Sign in to the IAM Identity Center console from the management account or delegated administrator account.
2. Under Users or Groups, create the users or groups that need access to AMG.
3. From the member account where the AMG workspace resides, open the Amazon Managed Grafana console.
4. Select the workspace and navigate to the Authentication tab.
5. Choose Configure users and user groups.
6. Search for the users or groups you created in step 2, then choose Assign user or Assign group.

Note: By designating an IAM Identity Center delegated administrator, you can perform IAM Identity Center administrative tasks (such as creating users and groups) without directly accessing the management account. For more information, see Delegated administrator for IAM Identity Center.

Option 2: SAML-based external IdP integration (alternative)

If accessing the Organization instance is not feasible due to organizational policies, or if you need to manage authentication independently within a member account, consider integrating with an external IdP using SAML.

Note: AMG supports enabling both SAML and IAM Identity Center simultaneously. However, SAML authentication targets an external IdP (such as Azure AD, Okta, or OneLogin), and you must configure user mappings separately from IAM Identity Center.

Recommendation: Clean Up the Account Instance

If you enabled an Account instance in a member account for the purpose of AMG integration, note that this instance cannot be used with AMG. If you have no other use for it, consider deleting it to avoid confusion.

Related information

• Organization and account instances of IAM Identity Center
• AWS managed applications that you can use with IAM Identity Center
• Use AWS IAM Identity Center with your Amazon Managed Grafana workspace
• Delegated administrator for IAM Identity Center
• Use SAML with your Amazon Managed Grafana workspace