Open Unified Identities › Group, filter Providers to AWS › SSO Group, then select a row to open its details. SSO groups are the groups of AWS IAM Identity Center (formerly AWS SSO).
SSO Groups
SSO Group Details
Details page contains the Risk and Exposure Point of the group, and the Information and Issues panes.
A permission set assigned to a group is inherited by every member. One group assignment can grant many users access to an account, so groups are often the shortest path to broad standing access.
SSO Group Details
Information
Information Pane contains Details, Members, Permission Sets and AWS accounts tabs. The Information Pane shows no badges for SSO groups.
Details
Details tab contains attributes below about the SSO group object.
| Attribute | Description |
|---|---|
| Display Name | The group’s display name. |
| Member Count | The number of SSO users in the group. |
| Description | The group description, if one is set. |
| Account ID | The account that hosts the Identity Center instance (management or delegated admin). |
| Group ID | The Identity Store group identifier. |
| Identity Store ID | The identity store the group belongs to (e.g., d-1234567890). |
| Object ID | The unique identifier of the group object. |
| External ID | The identifier the upstream identity provider assigned to this group, carried over by SCIM provisioning. Empty when the identity store is managed directly in Identity Center. |
| External ID Issuer | The identity store that issued the External ID, as an ARN. |
Members
Members tab contains a list of SSO users that belong to the group. Every member inherits the group’s permission set assignments. The list contains the Name, Username and Display Name columns.
Members
Permission Sets
Permission Sets tab contains a list of permission sets assigned to the group. Each one becomes an assumable role for every member in every account it is provisioned to. The list contains the Name, Description and Privileged columns.
Permission Sets
AWS accounts
AWS accounts tab lists the accounts the group can reach through its permission sets, and the role each permission set becomes in that account.
| Column | Description |
|---|---|
| Account | The account the group can access. |
| Permission Set | The permission set that grants the access in that account. |
| Assumable Role | The IAM role the permission set provisions in the account. |
AWS accounts
Issues
Issues pane contains identified security issues on the SSO group object.