AWS Single Sign-On Admin MCP Server

The AWS Single Sign-On Admin API, now operating under the AWS IAM Identity Center service, provides programmatic control over the centralized identity and access management of workforce users within an AWS environment. This service is the foundational layer for implementing a secure, scalable single sign-on solution that bridges on-premises directories, cloud identity providers like Azure Active Directory or Okta, and the entire AWS account structure. Its core capabilities are centered on the lifecycle management of permission sets, which are templates defining an AWS access role, and the assignment of these permission sets to users or groups from an integrated identity source across multiple AWS accounts. The endpoints facilitate creating, deleting, and modifying these permission sets, attaching managed or customer-managed AWS IAM policies to them, and managing instance-wide configurations for attribute-based access control (ABAC). This allows enterprises to move away from long-term credentials and instead grant just-in-time, least-privilege access to AWS resources based on a user's role or department, dramatically improving their security posture and operational efficiency during audits or team member onboarding and offboarding.