AWS singlesignon documentation change
Summary
Reorganized content structure, clarified account instance use cases, added guidance about organization instance preference, and removed redundant sections
Security assessment
Changes focus on improving documentation structure and usage guidance rather than addressing security vulnerabilities. The added emphasis on organization instances as the preferred choice helps prevent potential misconfigurations but doesn't directly document security fixes or features. No evidence of addressing specific security vulnerabilities in the diff.
Diff
diff --git a/singlesignon/latest/userguide/account-instances-identity-center.md b/singlesignon/latest/userguide/account-instances-identity-center.md index e2fb382e6..03e8e3c1b 100644 --- a//singlesignon/latest/userguide/account-instances-identity-center.md +++ b//singlesignon/latest/userguide/account-instances-identity-center.md @@ -5 +5 @@ -Availability constraints for member accountsWhen to use account instancesAccount instance considerationsSupported AWS managed applications +When to use an account instanceSupported AWS managed applicationsAvailability constraints for member accountsAccount instance considerations @@ -11 +11 @@ With an account instance of IAM Identity Center, you can deploy supported AWS ma -Account instances are bound to a single AWS account and are used only to manage user and group access for supported applications in the same account and AWS Region. You are limited to one account instance per AWS account. You can create an account instance from either of the following: +Account instances are bound to a single AWS account and are used only to manage user and group access for supported applications in the same account and AWS Region. You are limited to one account instance per AWS account. You can create an account instance from either of the following: a member account in AWS Organizations or a standalone AWS account that isn't managed by AWS Organizations. @@ -13 +13 @@ Account instances are bound to a single AWS account and are used only to manage - * A member account in AWS Organizations. +For instructions on enabling an account instance of IAM Identity Center, see [To enable an instance of IAM Identity Center](./enable-identity-center.html#to-enable-identity-center-instance) and choose the **Account** tab. @@ -15 +15 @@ Account instances are bound to a single AWS account and are used only to manage - * A standalone AWS account that is not managed by AWS Organizations. +## When to use an account instance @@ -16,0 +17 @@ Account instances are bound to a single AWS account and are used only to manage +In most cases, an [organization instance](./organization-instances-identity-center.html) is recommended. Use account instances only if one of the following scenarios applies: @@ -17,0 +19 @@ Account instances are bound to a single AWS account and are used only to manage + * You want to run a temporary trial of a supported AWS managed application to determine if the application suits your business needs. @@ -18,0 +21 @@ Account instances are bound to a single AWS account and are used only to manage + * You don’t have plans to adopt IAM Identity Center across your organization, but you want to support one or more AWS managed applications. @@ -20,5 +23 @@ Account instances are bound to a single AWS account and are used only to manage -###### Topics - - * Availability constraints for member accounts - - * When to use account instances + * You have an organization instance of IAM Identity Center, but you want to deploy a supported AWS managed application to an isolated set of users that are distinct from users in your organization instance. @@ -26 +25 @@ Account instances are bound to a single AWS account and are used only to manage - * Account instance considerations + * You don't control the AWS organization in which you operate. For example, a third-party controls the AWS organization that manages your AWS accounts. @@ -28 +26,0 @@ Account instances are bound to a single AWS account and are used only to manage - * AWS managed applications that support account instances @@ -30 +27,0 @@ Account instances are bound to a single AWS account and are used only to manage - * [Permit account instance creation in member accounts](./enable-account-instance-console.html) @@ -32 +28,0 @@ Account instances are bound to a single AWS account and are used only to manage - * [Use Service Control Policies to control account instance creation](./control-account-instance.html) @@ -34 +30 @@ Account instances are bound to a single AWS account and are used only to manage - * [Create an account instance of IAM Identity Center](./create-account-instance.html) +###### Important @@ -35,0 +32 @@ Account instances are bound to a single AWS account and are used only to manage +If you plan to use IAM Identity Center to support applications in multiple accounts, use an organization instance. Account instances don't support this use case. @@ -36,0 +34 @@ Account instances are bound to a single AWS account and are used only to manage +## AWS managed applications that support account instances @@ -37,0 +36 @@ Account instances are bound to a single AWS account and are used only to manage +See [AWS managed applications that you can use with IAM Identity Center](./awsapps-that-work-with-identity-center.html) to learn which AWS managed applications support account instances of IAM Identity Center. Verify the availability of account instance creation with your AWS managed application. @@ -63,19 +61,0 @@ After one of the preceding conditions is met, all of the following conditions mu -## When to use account instances - -In most cases, an [organization instance](./organization-instances-identity-center.html) is recommended. Account instances should be used only if one of the following scenarios applies: - - * You want to run a temporary trial of a supported AWS managed application to determine if the application suits your business needs. - - * You don’t have plans to adopt IAM Identity Center across your organization, but you want to support one or more AWS managed applications. - - * You have an organization instance of IAM Identity Center, but you want to deploy a supported AWS managed application to an isolated set of users that are distinct from users in your organization instance. - - * You don't control the AWS organization in which you operate. For example, a third-party controls the AWS organization that manages your AWS accounts. - - - - -###### Important - -If you plan to use IAM Identity Center to support applications in multiple accounts, use an organization instance. Account instances don't support this use case. - @@ -84 +64 @@ If you plan to use IAM Identity Center to support applications in multiple accou -An account instance is designed for specialized use cases, offering a subset of features available to an organization instance. Consider the following before creating an account instance: +An account instance is designed for specialized use cases, and offers a subset of features available to an organization instance. Consider the following before creating an account instance: @@ -88,3 +68 @@ An account instance is designed for specialized use cases, offering a subset of - * You can’t convert an account instance into an organization instance. - - * You can’t merge an account instance into an organization instance. + * You can’t convert or merge an account instance into an organization instance. @@ -103,6 +80,0 @@ An account instance is designed for specialized use cases, offering a subset of -## AWS managed applications that support account instances - -See [AWS managed applications](./awsapps.html) to learn which AWS managed applications support account instances of IAM Identity Center. Verify the availability of account instance creation with your AWS managed application. - -For instructions on enabling an account instance of IAM Identity Center, see [To enable an instance of IAM Identity Center](./enable-identity-center.html#to-enable-identity-center-instance). -