Summary

This was another tremendously long chapter filled with a ton of information. That said, this truly was only an introduction. AWS SSO has only recently become the strategic cornerstone for multi-account AWS account management in conjunction with AWS Organizations, and new best practices and patterns are still being established. That said, we learned how AWS Organizations is used to both bring existing accounts under centralized management as well as to provision net-new accounts within an organization. AWS SSO provides authentication and authorization for those accounts, as well as to third-party SaaS providers and AWS applications. Access to AWS accounts is governed by permission sets, which provide the template for the local AWS IAM roles that the users will assume in the target AWS accounts through identity federation.

The next chapter will provide a high-level overview of the remaining identity and identity-adjacent services that we need to be familiar with when implementing...