AWS.IdentityCenter reference

AccountAssignment

Source: src/AWS/IdentityCenter/AccountAssignment.ts

Assigns an IAM Identity Center permission set to a user or group in an AWS account.

AccountAssignment: Creating Assignments

const assignment = yield* AccountAssignment("ProdAdminAssignment", {
  permissionSetArn: admin.permissionSetArn,
  principalType: "GROUP",
  principalId: engineers.groupId,
  targetId: prod.accountId,
});

CreateGroupMembership

Source: src/AWS/IdentityCenter/CreateGroupMembership.ts

Runtime binding for the CreateGroupMembership operation (IAM action identitystore:CreateGroupMembership), scoped to one Instance.

Adds a user to a group in the bound instance’s identity store, returning the new MembershipId. The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.CreateGroupMembershipHttp).

CreateGroupMembership: Managing Group Memberships

// init — bind the operation to the Identity Center instance
const createGroupMembership = yield* AWS.IdentityCenter.CreateGroupMembership(instance);

// runtime
const { MembershipId } = yield* createGroupMembership({
  GroupId: groupId,
  MemberId: { UserId: userId },
});

CreateUser

Source: src/AWS/IdentityCenter/CreateUser.ts

Runtime binding for the CreateUser operation (IAM action identitystore:CreateUser), scoped to one Instance.

Creates a user in the bound instance’s identity store — e.g. a just-in-time provisioning Lambda mirroring users from an external HR system. The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.CreateUserHttp).

CreateUser: Managing Users

// init — bind the operation to the Identity Center instance
const createUser = yield* AWS.IdentityCenter.CreateUser(instance);

// runtime
const { UserId } = yield* createUser({
  UserName: "jdoe",
  DisplayName: "Jane Doe",
  Name: { GivenName: "Jane", FamilyName: "Doe" },
  Emails: [{ Value: "jdoe@example.com", Primary: true }],
});

DeleteGroupMembership

Source: src/AWS/IdentityCenter/DeleteGroupMembership.ts

Runtime binding for the DeleteGroupMembership operation (IAM action identitystore:DeleteGroupMembership), scoped to one Instance.

Removes a group membership from the bound instance’s identity store by MembershipId. The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.DeleteGroupMembershipHttp).

DeleteGroupMembership: Managing Group Memberships

// init — bind the operation to the Identity Center instance
const deleteGroupMembership = yield* AWS.IdentityCenter.DeleteGroupMembership(instance);

// runtime
yield* deleteGroupMembership({ MembershipId: membershipId });

DeleteUser

Source: src/AWS/IdentityCenter/DeleteUser.ts

Runtime binding for the DeleteUser operation (IAM action identitystore:DeleteUser), scoped to one Instance.

Deletes a user from the bound instance’s identity store — the deprovisioning half of a user-sync Lambda. The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.DeleteUserHttp).

DeleteUser: Managing Users

// init — bind the operation to the Identity Center instance
const deleteUser = yield* AWS.IdentityCenter.DeleteUser(instance);

// runtime
yield* deleteUser({ UserId: userId });

DescribeGroupMembership

Source: src/AWS/IdentityCenter/DescribeGroupMembership.ts

Runtime binding for the DescribeGroupMembership operation (IAM action identitystore:DescribeGroupMembership), scoped to one Instance.

Reads a group membership (group id + member id) from the bound instance’s identity store by MembershipId. The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.DescribeGroupMembershipHttp).

DescribeGroupMembership: Querying Group Memberships

// init — bind the operation to the Identity Center instance
const describeGroupMembership = yield* AWS.IdentityCenter.DescribeGroupMembership(instance);

// runtime
const membership = yield* describeGroupMembership({
  MembershipId: membershipId,
});
console.log(membership.GroupId, membership.MemberId);

DescribePermissionSet

Source: src/AWS/IdentityCenter/DescribePermissionSet.ts

Runtime binding for the DescribePermissionSet operation (IAM action sso:DescribePermissionSet), scoped to one Instance.

Reads a permission set’s details (name, description, session duration, relay state) from the bound Identity Center instance. The instance’s InstanceArn is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.DescribePermissionSetHttp).

DescribePermissionSet: Reading Permission Sets

// init — bind the operation to the Identity Center instance
const describePermissionSet = yield* AWS.IdentityCenter.DescribePermissionSet(instance);

// runtime
const { PermissionSet } = yield* describePermissionSet({
  PermissionSetArn: permissionSetArn,
});
console.log(PermissionSet?.Name, PermissionSet?.SessionDuration);

DescribeUser

Source: src/AWS/IdentityCenter/DescribeUser.ts

Runtime binding for the DescribeUser operation (IAM action identitystore:DescribeUser), scoped to one Instance.

Reads a user’s metadata and attributes (user name, display name, emails) from the bound instance’s identity store by UserId. The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.DescribeUserHttp).

DescribeUser: Looking Up Users

// init — bind the operation to the Identity Center instance
const describeUser = yield* AWS.IdentityCenter.DescribeUser(instance);

// runtime
const user = yield* describeUser({ UserId: userId });
console.log(user.UserName, user.DisplayName);

GetGroupId

Source: src/AWS/IdentityCenter/GetGroupId.ts

Runtime binding for the GetGroupId operation (IAM action identitystore:GetGroupId), scoped to one Instance.

Resolves a group’s GroupId from a unique attribute (e.g. the display name) in the bound instance’s identity store. The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.GetGroupIdHttp).

GetGroupId: Looking Up Groups

// init — bind the operation to the Identity Center instance
const getGroupId = yield* AWS.IdentityCenter.GetGroupId(instance);

// runtime
const { GroupId } = yield* getGroupId({
  AlternateIdentifier: {
    UniqueAttribute: {
      AttributePath: "displayName",
      AttributeValue: "platform-engineers",
    },
  },
});

GetGroupMembershipId

Source: src/AWS/IdentityCenter/GetGroupMembershipId.ts

Runtime binding for the GetGroupMembershipId operation (IAM action identitystore:GetGroupMembershipId), scoped to one Instance.

Resolves the MembershipId linking a user to a group in the bound instance’s identity store. The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.GetGroupMembershipIdHttp).

GetGroupMembershipId: Querying Group Memberships

// init — bind the operation to the Identity Center instance
const getGroupMembershipId = yield* AWS.IdentityCenter.GetGroupMembershipId(instance);

// runtime
const { MembershipId } = yield* getGroupMembershipId({
  GroupId: groupId,
  MemberId: { UserId: userId },
});

GetUserId

Source: src/AWS/IdentityCenter/GetUserId.ts

Runtime binding for the GetUserId operation (IAM action identitystore:GetUserId), scoped to one Instance.

Resolves a user’s UserId from a unique attribute (e.g. the user name) — the canonical login-to-id lookup for apps federated through Identity Center. The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.GetUserIdHttp).

GetUserId: Looking Up Users

// init — bind the operation to the Identity Center instance
const getUserId = yield* AWS.IdentityCenter.GetUserId(instance);

// runtime
const { UserId } = yield* getUserId({
  AlternateIdentifier: {
    UniqueAttribute: {
      AttributePath: "userName",
      AttributeValue: "jdoe",
    },
  },
});

Group

Source: src/AWS/IdentityCenter/Group.ts

A group in the IAM Identity Center identity store.

Group: Creating Groups

const engineers = yield* Group("PlatformEngineers", {
  displayName: "platform-engineers",
  description: "Platform engineering team",
});

Instance

Source: src/AWS/IdentityCenter/Instance.ts

An IAM Identity Center instance visible to the current account.

Use mode: "existing" to adopt a pre-enabled organization instance. Use mode: "account" only for standalone or member-account account instances.

Instance: Discovering Existing Instances

const instance = yield* Instance("IdentityCenter", {
  mode: "existing",
});

Instance: Creating Account Instances

const instance = yield* Instance("IdentityCenter", {
  mode: "account",
  name: "customer-a",
});

IsMemberInGroups

Source: src/AWS/IdentityCenter/IsMemberInGroups.ts

Runtime binding for the IsMemberInGroups operation (IAM action identitystore:IsMemberInGroups), scoped to one Instance.

Checks whether a user belongs to any of up to 100 groups in one call — the fast authorization primitive for group-gated routes. The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.IsMemberInGroupsHttp).

IsMemberInGroups: Querying Group Memberships

// init — bind the operation to the Identity Center instance
const isMemberInGroups = yield* AWS.IdentityCenter.IsMemberInGroups(instance);

// runtime
const { Results } = yield* isMemberInGroups({
  MemberId: { UserId: userId },
  GroupIds: [adminGroupId],
});
const isAdmin = Results?.[0]?.MembershipExists === true;

ListAccountAssignments

Source: src/AWS/IdentityCenter/ListAccountAssignments.ts

Runtime binding for the ListAccountAssignments operation (IAM action sso:ListAccountAssignments), scoped to one Instance.

Lists who (users/groups) holds a permission set in an AWS account — the core query of an access-review Lambda. The instance’s InstanceArn is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.ListAccountAssignmentsHttp).

ListAccountAssignments: Auditing Access

// init — bind the operation to the Identity Center instance
const listAccountAssignments = yield* AWS.IdentityCenter.ListAccountAssignments(instance);

// runtime
const { AccountAssignments } = yield* listAccountAssignments({
  AccountId: accountId,
  PermissionSetArn: permissionSetArn,
});

ListAccountAssignmentsForPrincipal

Source: src/AWS/IdentityCenter/ListAccountAssignmentsForPrincipal.ts

Runtime binding for the ListAccountAssignmentsForPrincipal operation (IAM action sso:ListAccountAssignmentsForPrincipal), scoped to one Instance.

Lists every account assignment a user or group holds across the organization — “what can this principal access?” for access portals. Only valid on organization instances, called from the management account. The instance’s InstanceArn is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.ListAccountAssignmentsForPrincipalHttp).

ListAccountAssignmentsForPrincipal: Auditing Access

// init — bind the operation to the Identity Center instance
const listAccountAssignmentsForPrincipal = yield* AWS.IdentityCenter.ListAccountAssignmentsForPrincipal(instance);

// runtime
const { AccountAssignments } = yield* listAccountAssignmentsForPrincipal({
  PrincipalId: groupId,
  PrincipalType: "GROUP",
});

ListAccountsForProvisionedPermissionSet

Source: src/AWS/IdentityCenter/ListAccountsForProvisionedPermissionSet.ts

Runtime binding for the ListAccountsForProvisionedPermissionSet operation (IAM action sso:ListAccountsForProvisionedPermissionSet), scoped to one Instance.

Lists the AWS accounts where a permission set is provisioned, one page per call (NextToken paginates). The instance’s InstanceArn is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.ListAccountsForProvisionedPermissionSetHttp).

ListAccountsForProvisionedPermissionSet: Auditing Access

// init — bind the operation to the Identity Center instance
const listAccountsForProvisionedPermissionSet = yield* AWS.IdentityCenter.ListAccountsForProvisionedPermissionSet(instance);

// runtime
const { AccountIds } = yield* listAccountsForProvisionedPermissionSet({
  PermissionSetArn: permissionSetArn,
});

ListGroupMemberships

Source: src/AWS/IdentityCenter/ListGroupMemberships.ts

Runtime binding for the ListGroupMemberships operation (IAM action identitystore:ListGroupMemberships), scoped to one Instance.

Lists the members of a group in the bound instance’s identity store, one page per call (NextToken paginates). The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.ListGroupMembershipsHttp).

ListGroupMemberships: Querying Group Memberships

// init — bind the operation to the Identity Center instance
const listGroupMemberships = yield* AWS.IdentityCenter.ListGroupMemberships(instance);

// runtime
const { GroupMemberships } = yield* listGroupMemberships({
  GroupId: groupId,
});

ListGroupMembershipsForMember

Source: src/AWS/IdentityCenter/ListGroupMembershipsForMember.ts

Runtime binding for the ListGroupMembershipsForMember operation (IAM action identitystore:ListGroupMembershipsForMember), scoped to one Instance.

Lists every group a user belongs to in the bound instance’s identity store, one page per call (NextToken paginates). The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.ListGroupMembershipsForMemberHttp).

ListGroupMembershipsForMember: Querying Group Memberships

// init — bind the operation to the Identity Center instance
const listGroupMembershipsForMember = yield* AWS.IdentityCenter.ListGroupMembershipsForMember(instance);

// runtime
const { GroupMemberships } = yield* listGroupMembershipsForMember({
  MemberId: { UserId: userId },
});

ListGroups

Source: src/AWS/IdentityCenter/ListGroups.ts

Runtime binding for the ListGroups operation (IAM action identitystore:ListGroups), scoped to one Instance.

Lists the groups in the bound instance’s identity store, one page per call (NextToken paginates); pass Filters to narrow by attribute. The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.ListGroupsHttp).

ListGroups: Looking Up Groups

// init — bind the operation to the Identity Center instance
const listGroups = yield* AWS.IdentityCenter.ListGroups(instance);

// runtime
const { Groups } = yield* listGroups({ MaxResults: 50 });
console.log(Groups?.map((group) => group.DisplayName));

ListPermissionSets

Source: src/AWS/IdentityCenter/ListPermissionSets.ts

Runtime binding for the ListPermissionSets operation (IAM action sso:ListPermissionSets), scoped to one Instance.

Lists the permission set ARNs in the bound Identity Center instance, one page per call (NextToken paginates). The instance’s InstanceArn is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.ListPermissionSetsHttp).

ListPermissionSets: Reading Permission Sets

// init — bind the operation to the Identity Center instance
const listPermissionSets = yield* AWS.IdentityCenter.ListPermissionSets(instance);

// runtime
const { PermissionSets } = yield* listPermissionSets({ MaxResults: 100 });

ListUsers

Source: src/AWS/IdentityCenter/ListUsers.ts

Runtime binding for the ListUsers operation (IAM action identitystore:ListUsers), scoped to one Instance.

Lists the users in the bound instance’s identity store, one page per call (NextToken paginates); pass Filters to narrow by attribute. The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.ListUsersHttp).

ListUsers: Looking Up Users

// init — bind the operation to the Identity Center instance
const listUsers = yield* AWS.IdentityCenter.ListUsers(instance);

// runtime
const { Users, NextToken } = yield* listUsers({ MaxResults: 50 });
console.log(Users?.map((user) => user.UserName));

PermissionSet

Source: src/AWS/IdentityCenter/PermissionSet.ts

An IAM Identity Center permission set.

PermissionSet: Creating Permission Sets

const admin = yield* PermissionSet("AdministratorAccess", {
  name: "AdministratorAccess",
  description: "Administrator access for platform engineers",
  sessionDuration: "8 hours",
});

UpdateUser

Source: src/AWS/IdentityCenter/UpdateUser.ts

Runtime binding for the UpdateUser operation (IAM action identitystore:UpdateUser), scoped to one Instance.

Applies attribute patch operations to a user in the bound instance’s identity store (display name, emails, addresses, …). The instance’s IdentityStoreId is injected from the binding. Provide the implementation with Effect.provide(AWS.IdentityCenter.UpdateUserHttp).

UpdateUser: Managing Users

// init — bind the operation to the Identity Center instance
const updateUser = yield* AWS.IdentityCenter.UpdateUser(instance);

// runtime
yield* updateUser({
  UserId: userId,
  Operations: [
    { AttributePath: "displayName", AttributeValue: "Jane A. Doe" },
  ],
});