Executive summary
As organizations scale their Amazon Web Services (AWS) footprint across hundreds or thousands of accounts and application services, security and compliance teams need to know exactly which permissions users hold in exactly which resources. Today, Okta supports entitlement management for AWS, extending Okta Identity Governance directly to AWS Identity and Access Management (IAM) Account Access Manager (AAM), with plans to provide an out-of-the-box connector. This integration enables security teams to gain fine-grained visibility, enforce least-privilege access, and manage just-in-time permissions across AWS environments down to the specific IAM role level.
Granular visibility and full-lifecycle governance
Historically, organizations have used Okta to govern AWS IAM Identity Center primarily through groups—a construct designed to manage SaaS resources rather than cloud infrastructure. Cloud environments, especially multicloud setups, have a highly complex and dynamic system of users, accounts, and associated permissions for various resources, making them challenging to manage.
Today, as part of Okta Identity Governance, organizations can use Entitlement Management and APIs to model an AWS account as an app in Okta and model assignable roles as entitlements within the app. Okta plans to support an out-of-the-box integration with AWS early next year. This more robust integration arrives as AWS introduces AWS IAM Account Access Manager (AAM), which lets customers centrally assign workforce users and groups to their existing IAM roles across an AWS organization, on its own or alongside permission sets.
AAM maps directly to the IAM roles you've already configured in your AWS accounts. Because it uses your existing roles, you retain access to the full set of IAM capabilities you’re already familiar with, and helps eliminate the need to recreate or translate your permissions into a new format. Okta governs the assignment of those roles, and together, these advances mean customers get both a modern way to manage account access in AWS and the governance depth to keep it secure.
How Okta Entitlement Management works in AWS environments
Consider a global company with hundreds of AWS accounts, organized by business unit and environment (for example, development, staging, and production), with Okta as the identity provider for its more than 20,000 employees:
- Without granular entitlement management: The security team can only confirm that an engineer accessed an AWS environment; determining which IAM roles and permission sets they have across accounts requires manually cross-referencing AWS console data. This approach doesn’t scale as complexity grows.
- With Okta Entitlement Management: The company can now see precisely what access an engineer holds: a power-user-scoped IAM role on a production AWS account, specifically for the finance department.
Key operational benefits
- Just-in-time access: If this engineer requires emergency access to address a site outage, they can request and receive approval for time-bound access that expires after the approved duration.
- Precision access reviews: During access certifications, reviewers can approve or revoke IAM roles in specific accounts without disrupting the engineer's access elsewhere.
- Separation of duties: Checks and balances for administrative scopes and controls can be easily maintained. AAM is purpose-built for managing workforce access to AWS accounts, separate from how you manage access to business applications in IAM Identity Center.
- Audit acceleration: The result is faster audits, tighter least-privilege enforcement, and governance that scales alongside growing AWS account complexity.
Okta’s deepening collaboration with AWS
Today, Okta delivers Entitlement Management for critical applications, enabling customers to grant, revoke, and audit user privileges at a granular level.
By working in lockstep with AWS, Okta extends these capabilities to AWS IAM Identity Center and AAM. AAM synchronizes users and groups from Okta into IAM Identity Center and then maps them to existing IAM roles, providing the core governance capabilities needed to manage and enforce least-privilege access across AWS accounts.
In the next year, Okta will deliver an out-of-the-box connector that natively integrates with AWS accounts, roles, and permission sets, all managed within a single application. Additional support for other infrastructure-as-a-service (IaaS) solutions will also be released over time. For now, read our perspective on modern entitlement management or learn how you can leverage Entitlement Management today by reviewing the product documentation.
Amazon Web Services, AWS, and AWS Identity and Access Management (IAM) are trademarks of Amazon.com, Inc., or its affiliates.
These materials are intended for general informational purposes only and do not constitute legal, privacy, security, compliance, or business advice. Additionally, any mention of future products, features, functionalities, or certifications is not a commitment to deliver and should not be relied upon to make purchasing decisions. ©2026 Okta, Inc. and/or its affiliates.
