---
title: "Enable Account Access Manager"
slug: "enable-account-access-manager"
updated: 2026-09-07T14:11:29Z
published: 2026-09-07T14:11:29Z
canonical: "docs.britive.com/enable-account-access-manager"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.britive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable Account Access Manager

The AWS Account Access Manager must be enabled on the management account. It can only be enabled in the region where IAM Identity Center was first enabled for the organization, known as the primary region.

## Prerequisite (Conditional): AWS Key Management Service (AWS KMS)

This applies only if your IAM Identity Center instance uses a customer-managed key, including a multi-region instance. If you do not use a customer-managed key, skip this step. AWS requires the account access manager to have *kms:Decrypt* permission for that key so it can decrypt IAM Identity Center data when connecting to the instance. Without it, the account access manager may fail to connect, or later operations may fail with a *kms:Decrypt access-denied* error. Grant the permission through the IAM Identity Center customer-managed key policy. It is not added to the Britive integration role. See the [Baseline KMS key policy](https://docs.aws.amazon.com/singlesignon/latest/userguide/baseline-KMS-key-policy.html).

Complete this before enabling the account access manager.

1. From the management account, enable trusted service access for the account access manager:

```bash
aws organizations enable-aws-service-access \
    --service-principal account-access.amazonaws.com
```
2. Sign in to the management account and open [https://<primary-region>[.console.aws.amazon.com/account-access/]().](https://&lt;primary-region&gt;[.console.aws.amazon.com/account-access/]().)
3. If the page displays **Enable Account Access**, select it.
4. Open the **Settings** page. The application ARN is shown there, and the **Application URL** is in

the **Instance details** section.
5. Copy both values. They are required when you add the application in Britive.

> [!NOTE]
> Note:
> 
> IAM Identity Center also lists an application named **AWS account access** whose ARN begins with `arn:aws:sso::`. This ARN is not supported and causes the connection test to fail. Use only the ARN from the account access manager **Settings** page, which begins with `arn:aws:account-access:`.

## Network allowlisting

If your organization filters web traffic—for example, through a corporate VPN, firewall, or secure web gateway—allow the account access manager endpoints before users sign in. See [AWS network allowlisting requirements](https://www.google.com/search?q=https://docs.aws.amazon.com/IAM/latest/UserGuide/account-access-manager-update-firewalls).

## Configuring integration role permissions

Britive creates an entitlement when a profile is checked out and deletes it when the profile is checked in. The integration role therefore requires *write* access to the account access manager APIs, in addition to the read permissions used for scanning. Attach the following policy to the integration role in the management account:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DiscoverApplications",
      "Effect": "Allow",
      "Action": "account-access:ListApplications",
      "Resource": "*"
    },
    {
      "Sid": "ManageEntitlements",
      "Effect": "Allow",
      "Action": [
        "account-access:ListEntitlements",
        "account-access:CreateEntitlement",
        "account-access:DeleteEntitlement"
      ],
      "Resource": "arn:aws:account-access:<region>:<management-account-id>:application/<application-id>"
    }
  ]
}
```

Britive uses *ListApplications* during **Save and Test** to verify that the entered application Amazon Resource Name (ARN) exists in the configured management account and region. AWS does not currently support resource-level scoping for this action, so it requires "Resource": "*".