# AWS IAM Identity Center

> Manage the workforce directory of AWS IAM Identity Center: create, update and delete users and groups, manage group membership, look people up by user name or email, and read the Identity Center instance.

App · Compliance & Security · 20 actions. Web page: https://docs.lodol.com/docs/integrations/aws-identity-center

## Actions

### Add user to group

Add a user to a group. If they are already a member, the existing membership is returned instead of an error.

**Inputs**

- Group ID (`group_id`, text, required): The group's ID, from Create group, List groups or Find group ID. A URL copied from the group's page in the console works too.
- User ID (`user_id`, text, required): The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "already_member": false,
    "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
    "membership_id": "9067abcdef-c3d4e5f6-7890-12ab-cdef-333344445555",
    "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
  }
}
```

### Check user in groups

Check which of up to 100 groups a user belongs to.

**Inputs**

- User ID (`user_id`, text, required): The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.
- Group IDs (`group_ids`, list, required): The groups to check, up to 100.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "member_of_all": true,
    "member_of_any": true,
    "results": [
      {
        "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
        "is_member": true,
        "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
      }
    ]
  }
}
```

### Create group

Create a group in the Identity Center directory. Group names must be unique.

**Inputs**

- Group name (`display_name`, text, required): The group's name, e.g. 'Engineering'.
- Description (`description`, text): What the group is for.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "display_name": "Engineering",
    "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
    "identity_store_id": "d-9067abcdef"
  }
}
```

### Create user

Add a user to the Identity Center directory. Works only when the identity source is the Identity Center directory, not an external identity provider or Active Directory.

**Inputs**

- User name (`user_name`, text, required): The sign-in name, unique in the directory and without spaces, for example 'jane.doe'.
- Display name (`display_name`, text, required): The full name shown in the console, e.g. 'Jane Doe'.
- First name (`given_name`, text, required): The user's first name.
- Last name (`family_name`, text, required): The user's last name.
- Email (`email`, text): The user's email address. Must be unique in the directory.
- Email type (`email_type`, text): Which kind of address this is. Defaults to Work. One of: `work`, `home`, `other`. Default: `work`.
- Phone (`phone_number`, text): A phone number.
- Phone type (`phone_type`, text): Which kind of number this is. Defaults to Work. One of: `work`, `mobile`, `home`, `fax`, `pager`, `other`. Default: `work`.
- Job title (`title`, text): Job title.
- Nickname (`nick_name`, text): A casual name.
- User type (`user_type`, text): Your own classification, e.g. 'Employee' or 'Contractor'.
- Preferred language (`preferred_language`, text): Preferred language, e.g. 'en-US'.
- Locale (`locale`, text): Locale, e.g. 'en-US'.
- Time zone (`timezone`, text): Time zone, e.g. 'America/New_York'.
- Birth date (`birthdate`, date): The user's date of birth.
- Enterprise attributes (`enterprise_attributes`, object): Optional employeeNumber, costCenter, organization, division, department and manager (a user ID).

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "identity_store_id": "d-9067abcdef",
    "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333",
    "user_name": "jane.doe"
  }
}
```

### Delete group

Permanently delete a group. Its members keep their accounts. This cannot be undone.

**Inputs**

- Group ID (`group_id`, text, required): The group's ID, from Create group, List groups or Find group ID. A URL copied from the group's page in the console works too.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "deleted": true,
    "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444"
  }
}
```

### Delete user

Permanently delete a user and their group memberships. This cannot be undone.

**Inputs**

- User ID (`user_id`, text, required): The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "deleted": true,
    "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
  }
}
```

### Describe instance

Read an Identity Center instance's status, encryption and whether multi-account permissions are on.

**Inputs**

- Instance (`instance_arn`, text): The instance to describe. Leave empty to use the region's only instance.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "instance": {
      "created_at": "2026-09-10T00:26:40Z",
      "encryption": null,
      "identity_store_id": "d-9067abcdef",
      "instance_arn": "arn:aws:sso:::instance/ssoins-72231a2b3c4d5e6f",
      "name": "My instance",
      "owner_account_id": "111122223333",
      "permission_sets_enabled": null,
      "primary_region": "us-east-1",
      "regions": [
        {
          "added_at": "2026-09-10T00:26:40Z",
          "is_primary_region": true,
          "region_name": "us-east-1",
          "status": "ACTIVE"
        }
      ],
      "status": "ACTIVE",
      "status_reason": null
    }
  }
}
```

### Find group ID

Find a group's ID from its name or external ID. Returns found = false rather than failing when nothing matches.

**Inputs**

- Look up by (`lookup_by`, text, required): Which attribute the value below is. One of: `displayName` (Group name), `externalId` (External ID (from your identity provider)). Default: `displayName`.
- Value (`value`, text, required): The group name or external ID. Matching is exact.
- External ID issuer (`external_id_issuer`, text): Only for External ID: the issuer your identity provider set on the group.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "found": true,
    "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444"
  }
}
```

### Find user ID

Find a user's ID from their user name, email or external ID. Returns found = false rather than failing when nobody matches.

**Inputs**

- Look up by (`lookup_by`, text, required): Which attribute the value below is. One of: `userName` (User name), `emails.value` (Email), `externalId` (External ID (from your identity provider)). Default: `userName`.
- Value (`value`, text, required): The user name, email address or external ID to find. Matching is exact.
- External ID issuer (`external_id_issuer`, text): Only for External ID: the issuer your identity provider set on the user.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "found": true,
    "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
  }
}
```

### Get group

Read one group's name and description.

**Inputs**

- Group ID (`group_id`, text, required): The group's ID, from Create group, List groups or Find group ID. A URL copied from the group's page in the console works too.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "group": {
      "created_at": "2026-09-10T00:26:40Z",
      "created_by": null,
      "description": "Everyone in engineering",
      "display_name": "Engineering",
      "external_ids": [],
      "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
      "identity_store_id": "d-9067abcdef",
      "updated_at": "2026-09-10T00:26:40Z",
      "updated_by": null
    }
  }
}
```

### Get group membership

Check whether a user is in a group and get the membership ID. Returns is_member = false rather than failing when they are not.

**Inputs**

- Group ID (`group_id`, text, required): The group's ID, from Create group, List groups or Find group ID. A URL copied from the group's page in the console works too.
- User ID (`user_id`, text, required): The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "is_member": true,
    "membership_id": "9067abcdef-c3d4e5f6-7890-12ab-cdef-333344445555"
  }
}
```

### Get user

Read one user's profile.

**Inputs**

- User ID (`user_id`, text, required): The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.
- Include enterprise attributes (`include_enterprise_attributes`, true/false): Also return department, employee number, cost center and manager. Default: `false`.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "user": {
      "address": null,
      "birthdate": null,
      "created_at": "2026-09-10T00:26:40Z",
      "created_by": null,
      "display_name": "Jane Doe",
      "email": "jane.doe@example.com",
      "email_type": "work",
      "enterprise": null,
      "external_ids": [],
      "family_name": "Doe",
      "formatted_name": null,
      "given_name": "Jane",
      "honorific_prefix": null,
      "honorific_suffix": null,
      "identity_store_id": "d-9067abcdef",
      "locale": null,
      "middle_name": null,
      "nick_name": null,
      "phone_number": null,
      "phone_type": null,
      "photo_urls": [],
      "preferred_language": null,
      "profile_url": null,
      "role": null,
      "status": "ENABLED",
      "timezone": null,
      "title": "Engineer",
      "updated_at": "2026-09-10T00:26:40Z",
      "updated_by": null,
      "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333",
      "user_name": "jane.doe",
      "user_type": null,
      "website": null
    }
  }
}
```

### List group members

List one page of a group's memberships.

**Inputs**

- Group ID (`group_id`, text, required): The group's ID, from Create group, List groups or Find group ID. A URL copied from the group's page in the console works too.
- Page size (`max_results`, number): How many records to return (1-100). From 1 to 100.
- Next page token (`next_token`, text): The next_token from the previous page. Leave empty for page one.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "has_more": false,
    "memberships": [
      {
        "created_at": "2026-09-10T00:26:40Z",
        "created_by": null,
        "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
        "identity_store_id": "d-9067abcdef",
        "membership_id": "9067abcdef-c3d4e5f6-7890-12ab-cdef-333344445555",
        "updated_at": null,
        "updated_by": null,
        "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
      }
    ],
    "next_token": null
  }
}
```

### List groups

List one page of the groups in the identity store.

**Inputs**

- Page size (`max_results`, number): How many records to return (1-100). From 1 to 100.
- Next page token (`next_token`, text): The next_token from the previous page. Leave empty for page one.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "groups": [
      {
        "created_at": "2026-09-10T00:26:40Z",
        "created_by": null,
        "description": "Everyone in engineering",
        "display_name": "Engineering",
        "external_ids": [],
        "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
        "identity_store_id": "d-9067abcdef",
        "updated_at": "2026-09-10T00:26:40Z",
        "updated_by": null
      }
    ],
    "has_more": false,
    "next_token": null
  }
}
```

### List instances

List the IAM Identity Center instances in the connection's region, with each one's identity store ID and status.

**Inputs**

- Page size (`max_results`, number): How many records to return (1-100). From 1 to 100.
- Next page token (`next_token`, text): The next_token from the previous page. Leave empty for page one.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "has_more": false,
    "instances": [
      {
        "created_at": "2026-09-10T00:26:40Z",
        "encryption": null,
        "identity_store_id": "d-9067abcdef",
        "instance_arn": "arn:aws:sso:::instance/ssoins-72231a2b3c4d5e6f",
        "name": "My instance",
        "owner_account_id": "111122223333",
        "permission_sets_enabled": null,
        "primary_region": "us-east-1",
        "regions": [
          {
            "added_at": "2026-09-10T00:26:40Z",
            "is_primary_region": true,
            "region_name": "us-east-1",
            "status": "ACTIVE"
          }
        ],
        "status": "ACTIVE",
        "status_reason": null
      }
    ],
    "next_token": null
  }
}
```

### List user's groups

List one page of the groups a user belongs to.

**Inputs**

- User ID (`user_id`, text, required): The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.
- Page size (`max_results`, number): How many records to return (1-100). From 1 to 100.
- Next page token (`next_token`, text): The next_token from the previous page. Leave empty for page one.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "has_more": false,
    "memberships": [
      {
        "created_at": "2026-09-10T00:26:40Z",
        "created_by": null,
        "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
        "identity_store_id": "d-9067abcdef",
        "membership_id": "9067abcdef-c3d4e5f6-7890-12ab-cdef-333344445555",
        "updated_at": null,
        "updated_by": null,
        "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
      }
    ],
    "next_token": null
  }
}
```

### List users

List one page of the users in the identity store.

**Inputs**

- Page size (`max_results`, number): How many records to return (1-100). From 1 to 100.
- Next page token (`next_token`, text): The next_token from the previous page. Leave empty for page one.
- Include enterprise attributes (`include_enterprise_attributes`, true/false): Also return department, employee number, cost center and manager. Default: `false`.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "has_more": false,
    "next_token": null,
    "users": [
      {
        "address": null,
        "birthdate": null,
        "created_at": "2026-09-10T00:26:40Z",
        "created_by": null,
        "display_name": "Jane Doe",
        "email": "jane.doe@example.com",
        "email_type": "work",
        "enterprise": null,
        "external_ids": [],
        "family_name": "Doe",
        "formatted_name": null,
        "given_name": "Jane",
        "honorific_prefix": null,
        "honorific_suffix": null,
        "identity_store_id": "d-9067abcdef",
        "locale": null,
        "middle_name": null,
        "nick_name": null,
        "phone_number": null,
        "phone_type": null,
        "photo_urls": [],
        "preferred_language": null,
        "profile_url": null,
        "role": null,
        "status": "ENABLED",
        "timezone": null,
        "title": "Engineer",
        "updated_at": "2026-09-10T00:26:40Z",
        "updated_by": null,
        "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333",
        "user_name": "jane.doe",
        "user_type": null,
        "website": null
      }
    ]
  }
}
```

### Remove user from group

Remove a user from a group, by membership ID or by group and user. Removing someone who is not a member changes nothing and returns removed = false.

**Inputs**

- Membership ID (`membership_id`, text): The membership to remove, from Add user to group or List group members. Or leave empty and give the group and user.
- Group ID (`group_id`, text): The group, if no membership ID is given.
- User ID (`user_id`, text): The user, if no membership ID is given.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "membership_id": "9067abcdef-c3d4e5f6-7890-12ab-cdef-333344445555",
    "removed": true
  }
}
```

### Update group

Rename a group, or change or remove its description.

**Inputs**

- Group ID (`group_id`, text, required): The group's ID, from Create group, List groups or Find group ID. A URL copied from the group's page in the console works too.
- Group name (`display_name`, text): New group name.
- Description (`description`, text): New description.
- Remove description (`clear_description`, true/false): Remove the group's description entirely. Default: `false`.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
    "updated": true,
    "updated_attributes": [
      "description"
    ]
  }
}
```

### Update user

Change a user's attributes. Only the fields you fill in are changed; everything else is left as it is.

**Inputs**

- User ID (`user_id`, text, required): The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.
- User name (`user_name`, text): New sign-in name (no spaces).
- Display name (`display_name`, text): New display name.
- First name (`given_name`, text): New first name.
- Last name (`family_name`, text): New last name.
- Nickname (`nick_name`, text): New nickname.
- Job title (`title`, text): New job title.
- User type (`user_type`, text): New user type.
- Email (`email`, text): New email address.
- Email type (`email_type`, text): Which kind of address this is. Defaults to Work. One of: `work`, `home`, `other`. Default: `work`.
- Phone (`phone_number`, text): New phone number.
- Phone type (`phone_type`, text): Which kind of number this is. Defaults to Work. One of: `work`, `mobile`, `home`, `fax`, `pager`, `other`. Default: `work`.
- Preferred language (`preferred_language`, text): New preferred language.
- Locale (`locale`, text): New locale.
- Time zone (`timezone`, text): New time zone.
- Department (`department`, text): New department (an enterprise attribute).
- Advanced changes (`operations`, list): Other attributes to set or remove, as a list of {"attribute_path": ..., "attribute_value": ...}. Leave out attribute_value to remove the attribute.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "updated": true,
    "updated_attributes": [
      "title"
    ],
    "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
  }
}
```