Context: I am using Account Factory through Control Tower to create accounts. I am doing this dynamically through Terraform.
Problem: Users that are created through the Account Factory (Service Catalog Provisioned Product) receive an automatic invitation to the IAM Identity Center with the link to the SSO portal. Users that I assign access to certain sandbox accounts, but which don't have their own sandboxes, don't receive an invitation unless the 'Send email verification link' is clicked for the specific user in the IAM Identity Center, and then the assigned user can click 'Forgot Password' to make a new password for themselves once the email is verified.
Goal: Users that are created through IAM Identity Center and not with the Account Factory, but are given access to a sandbox account through an account assignment in IAM Identity Center, should also receive an invitation to the SSO portal.
For reference, an excerpt from a JSON file looks like this:
{
"AccountName": "SandboxOne",
"SSOUserEmail": "sandbox1@sandbox.com",
"SSOUserFirstName": "Sandbox",
"SSOUserLastName": "One",
"AccountEmail": "sandbox1@sandbox.com",
"ManagedOrganizationalUnit": "Year 1",
"Budget": 100,
"Users": [
{
"Email": "sandbox1-existinguser@sandbox.com",
"FirstName": "John",
"LastName": "Doe"
},
{
"Email": "sandbox2-newuser@sandbox.com",
"FirstName": "Jane",
"LastName": "Doe"
}
]
},
To take this example: The SSOUserEmail will receive an invitation to join the IAM Identity Center portal. The other emails under 'Users' will not. For the first user in 'Users', if they already have a different sandbox for themselves, they will see the second (new) sandbox pop up in their SSO portal as a sign-in option. This is fine. However, the email for the second user which does not have their own sandbox, but is granted access to a different sandbox not under their own name, will not receive any notifications or email when their user is created unless prompted manually through management.
How can I onboard users to IAM Identity Center without manually sending verification emails?
Any help is appreciated, thank you.
Thank you for your helpful answer!
Happy to help! If you feel I answered your question sufficiently, please take the time to accept my answer to mark the question as answered.