search

aws-samples / iam-identity-center-team

Open-source temporary elevated access solution for AWS IAM Identity Center.
https://aws-samples.github.io/iam-identity-center-team/
MIT No Attribution
285 stars 67 forks source link

Identity center instance cannot be created or carried over if an organization is created after identity center is already enabled. #281

Open saraheb-aws opened 1 month ago

saraheb-aws commented 1 month ago

Describe the bug I enabled identity center without first creating my organization. I then created my organization and navigated back to identity center. The splash page to enable IC was displayed, but when I clicked enable it told me It was already enabled in the region I was in.

I ran this script and the output was that it was already enabled in the region I was in. `regions=$(aws ec2 describe-regions --query "Regions[*].RegionName" --output text)

for region in $regions; do echo "Executing in region: $region" aws sso-admin list-instances --region "$region" echo "----------------------------------------" done`

I had to delete my org then delete my identity center instance then re-create the org and re-enable Identity center. It seems that Identity center that was enabled in the account should be available to the user after an organization is created.

To Reproduce Steps to reproduce the behavior: Make sure there is no identity center instance or organizations instance

  1. Go to 'Identity Center console'
  2. Click on 'Enable'
  3. Go to organizations and click 'create and organization'
  4. Navigate back to identity center to manage it
  5. See that its no longer there and cannot be enabled

Expected behavior Make sure there is no identity center instance or organizations instance

  1. Go to 'Identity Center console'
  2. Click on 'Enable'
  3. Go to organizations and click 'create and organization'
  4. Navigate back to identity center to manage it
  5. Manage identity center normally.

Screenshots Screenshot 2024-07-15 at 4 18 03 PM

Desktop (please complete the following information):

StevenSmiley commented 1 month ago

It seems you are describing a behavior of AWS IAM Identity Center, not an issue with the TEAM application. Identity Center now supports different instance types, including organization instances and account instances. See https://docs.aws.amazon.com/singlesignon/latest/userguide/identity-center-instances.html