Enable Account Access Manager

The AWS Account Access Manager must be enabled on the management account. It can only be enabled in the region where IAM Identity Center was first enabled for the organization, known as the primary region.

Prerequisite (Conditional): AWS Key Management Service (AWS KMS)

This applies only if your IAM Identity Center instance uses a customer-managed key, including a multi-region instance. If you do not use a customer-managed key, skip this step. AWS requires the account access manager to have kms:Decrypt permission for that key so it can decrypt IAM Identity Center data when connecting to the instance. Without it, the account access manager may fail to connect, or later operations may fail with a kms:Decrypt access-denied error. Grant the permission through the IAM Identity Center customer-managed key policy. It is not added to the Britive integration role. See the Baseline KMS key policy.

Complete this before enabling the account access manager.

1. From the management account, enable trusted service access for the account access manager:

   aws organizations enable-aws-service-access \
       --service-principal account-access.amazonaws.com

2. Sign in to the management account and open https://<primary-region>[.console.aws.amazon.com/account-access/]().

3. If the page displays Enable Account Access, select it.

4. Open the Settings page. The application ARN is shown there, and the Application URL is in

   the Instance details section.

5. Copy both values. They are required when you add the application in Britive.

   Note:

   IAM Identity Center also lists an application named AWS account access whose ARN begins with arn:aws:sso::. This ARN is not supported and causes the connection test to fail. Use only the ARN from the account access manager Settings page, which begins with arn:aws:account-access:.

Network allowlisting

If your organization filters web traffic—for example, through a corporate VPN, firewall, or secure web gateway—allow the account access manager endpoints before users sign in. See AWS network allowlisting requirements.

Configuring integration role permissions

Britive creates an entitlement when a profile is checked out and deletes it when the profile is checked in. The integration role therefore requires write access to the account access manager APIs, in addition to the read permissions used for scanning. Attach the following policy to the integration role in the management account:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DiscoverApplications",
      "Effect": "Allow",
      "Action": "account-access:ListApplications",
      "Resource": "*"
    },
    {
      "Sid": "ManageEntitlements",
      "Effect": "Allow",
      "Action": [
        "account-access:ListEntitlements",
        "account-access:CreateEntitlement",
        "account-access:DeleteEntitlement"
      ],
      "Resource": "arn:aws:account-access:<region>:<management-account-id>:application/<application-id>"
    }
  ]
}

Britive uses ListApplications during Save and Test to verify that the entered application Amazon Resource Name (ARN) exists in the configured management account and region. AWS does not currently support resource-level scoping for this action, so it requires "Resource": "*".