---
title: "AWS IAM Identity Center"
slug: "aws-iam-identity-center"
description: "This article will help connect your Clarity Security tenant to AWS IAM Identity Center (Successor to AWS Single Sign-On)."
tags: ["AWS", "Application Connectors", "Application Marketplace"]
updated: 2025-10-29T14:08:09Z
published: 2025-10-29T14:08:09Z
canonical: "help.claritysecurity.com/aws-iam-identity-center"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.claritysecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS IAM Identity Center

This guide will teach you how to set up the connector between AWS Identity Center and Clarity Security. **Estimated time to complete:** 15 minutes If you run into any problems, please contact your support team or [support@claritysecurity.io](mailto:support@claritysecurity.io).

---

## How to Setup the Connector

### Step 1: Log in to AWS

          AWS Region

          

Make sure your AWS region is correct once you have logged in.

### Step 2: Use the search function to navigate to IAM

Navigate to the IAM (Identity and Access Management) Service within AWS. ![aws search for iam](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20search%20for%20iam.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 3: Navigate to the Users section

On the IAM service screen, navigate to the Users area on the navigation pane on the left side. ![aws iam users](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20iam%20users.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 4: Create user

Click the **Create user** button on the screen, all of your current IAM users should be listed. ![aws iam create user](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20iam%20create%20user.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 5: Specify user details

Create a user name for your new user, be as descriptive as possible so its easy to understand the purpose of this new service account. (Ex: clarity-aws-iam-ic) ![aws iam create username](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20iam%20create%20username.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 6: Set permissions

Choose Attach policies directly and using the search box type: **"AWSSSO"**. Select the **AWSSSODirectoryAdministrator** policy and click **Next** (bottom right). ![aws iam set permissions](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20iam%20set%20permissions.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 7: Review and create

Confirm your user name and the attached policy. If everything matches what you expect, click **Create user** (bottom right). ![aws iam user confirm and create](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20iam%20user%20confirm%20and%20create.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 8: Select your new IAM user

On the IAM Users page (you should be brought here automatically), click on the blue name (**clarity-aws-iam-ic** in our example) for the user you just created. ![aws iam select your new user](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20iam%20select%20your%20new%20user.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 9: Click Create access key

On the details srceen for your new user, click the **Create access key** button in the upper right. ![aws iam click create access key](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20iam%20click%20create%20access%20key.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 10: Select "Other" user case

On the Access key best practices & alternatives select the **Other** use case and then click **Next** (bottom right). ![aws iam access key use case](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20iam%20access%20key%20use%20case.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 11: Optionally create a tag for the acess key.

Provide an optional tag for the access key, then click **Create access key**. ![aws iam create tag - optional](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20iam%20create%20tag%20-%20optional.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 12: Retrieve access keys

Copy the **Access key** and **Secret access key** in a secure location, these will be used later. Click **Done** once you have recorded these details. ![aws iam retrieve access key](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20iam%20retrieve%20access%20key.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 13: Use the search function to navigate back to IAM Identity Center

Using the search function at the top of the AWS page, search IAM but this time select **IAM Identity Center (successor to AWS Single Sign-On)**. ![aws iam ic search for iam.png](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20iam%20ic%20search%20for%20iam.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 14: Click on settings

Click on the **Settings** button in the upper left on the AWS IAM IC navigation pane. ![aws iam ic settings](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20iam%20ic%20settings.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 15: Collect the Region and Identity store ID

Collect the values for **Region** and **Identity store ID** from the settings page, these will be used in a later step. ![aws iam ic copy region and store id](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aws%20iam%20ic%20copy%20region%20and%20store%20id.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 16: Log in to your Clarity tenant

### Step 17: Click on the Applications page, then Marketplace

### Step 18: Search for AWS Identity Center and click Connect

On the Marketplace screen, search (top right) for **AWS Identity Center**, then click **Connect**. ![Application - Marketplace - AWS Identity Center](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Application%20-%20Marketplace%20-%20AWS%20Identity%20Center.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 19: Fill out the Connect App form

Details for fields common to all applications can be found in the following article: [Common App Configuration Steps](https://portal.document360.io/v1/docs/common-app-steps#step-1-connect-app)

**access_key_id**: This was collected in **Step 12**. **secret_access_key**: This was collected in **Step 12**. **identity_store_id**: This was collected in **Step 15**. **aws_region**: This was collected in **Step 15** (example: **us-east-2**).

![AWS Identity Center Clarity Onboarding Step 1](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/AWS%20Identity%20Center%20Clarity%20Onboarding%20Step%201.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 20: Fill out the App Settings form

Details for fields common to all applications can be found in the following article: [Common App Configuration Steps](https://portal.document360.io/dashboard#step-2-app-settings) ![image.png](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image%283%29.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 21: Fill out the User Settings form

Details for fields common to all applications can be found in the following article: [Common App Configuration Steps](https://portal.document360.io/dashboard#step-3-user-settings)

![image.png](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image%282%29.png?sv=2026-02-06&spr=https&st=2026-11-09T20%3A23%3A22Z&se=2026-11-09T21%3A23%3A22Z&sr=c&sp=r&sig=DGbO%2BVoUZocLacjRX0UOrerLC9C3N2t8io9TYCWXxtU%3D)

### Step 22: Validate Your Selections and Save

          Save

          

Clicking the Save button will trigger the first full sync for your application (even if you selected Manual syncing). This includes Service Users, Entitlements, Service User Entitlements, Service User Attributes.

---

## Need help?

If you have any problems, contact your customer success team. You can also get in touch with our general support [via email](mailto:support@claritysecurity.io), open a [support ticket](https://support.claritysecurity.com/home). Our general support team is available Monday - Friday from 8:00 AM - 6:30 PM CST.

A Service User is a user, or service account, discovered by Clarity in a downstream application.

An Entitlement is an assignable permission found in a downstream application. Common examples include licenses, groups, and policies.

Service User Entitlements are the pairings of users and active entitlement access in downstream applications.

An attribute is a piece of information used to describe a service user, entitlement, or identity. Common examples include First Name, Last Name, Job Title, Department, etc.