Set It Once, Sync It Forever: Duo Lifecycle Management for AWS Account Access Manager
As AWS footprints grow across many accounts, access becomes a manual patchwork: per-user role assignment, inconsistent MFA enforcement, slow onboarding, and lingering access after offboarding. AWS IAM Account Access Manager (AAM) gives administrators a faster way to grant workforce users direct, per-account IAM role entitlements, without having to design and maintain AWS IAM Identity Center permission sets for every team. Users get one portal where they can pick a role and receive federated credentials for the account they need—a meaningful simplification for any organization running dozens, or hundreds, of AWS accounts.
But, AAM relies entirely on the identity source behind IAM Identity Center for authentication and user lifecycle. Without strong, centrally enforced sign-in and automated provisioning, group memberships, and the access they grant, can drift from reality, creating audit risk and standing-access exposure that CISOs struggle to prove or fix. Cisco Duo's identity and access management platform closes both gaps at once: Duo SSO enforces risk-based access policies and strong, consistent MFA when users sign in to AWS, and Duo's SCIM-based lifecycle management keeps the groups behind those entitlements current automatically.
The Hidden Cost of Manual AWS Access Management
As an organization’s use of AWS and their products grows across business units, and regions, access management tends to become a patchwork. One team creates IAM roles by hand. Another tracks group membership in a spreadsheet. A new hire waits days for the right entitlement, while a departing employee's access lingers long after their last day, because no single system is watching both ends of the employee lifecycle at once. For a CISO, that gap between who should have access and who actually has it is exactly the kind of finding that turns a routine audit into a remediation project.
“94% of IT and security leaders say complexity in identity infrastructure challenges their security posture.”
AAM narrows the administrative half of that problem by replacing per-account permission-set design with direct role assignments. The other half, who can sign in and whether their access is still current, depends on the identity provider behind it.
Duo as the Identity Layer Behind Every AAM Sign-In
Configuring Duo SSO as the provider for your applications and as the external identity provider for AWS IAM Identity Center means every AAM sign-in is authenticated by Duo first. The access portal, console sessions and CLI credentials obtained with AWS login all come from that Duo-verified session. Because this is set once at the Identity Center layer, it applies uniformly across the entire AAM experience without any separate configuration inside AAM itself.
Consistent MFA everywhere: Every AAM session starts with the same Duo access and authentication policy, whether a user works in the console or through the CLI.
Broad authenticator support: Duo supports verified push notifications, biometrics, security keys, passkeys, TOTP, and SMS, so you can match MFA strength to risk without blocking legitimate users.
One policy to manage: Because the access policies and MFA requirements live in Duo and not in AAM, security teams adjust access and authentication policy in one place, and it applies to every subsequent AAM sign-in.
This same connection is also the foundation for attribute-based access control: Duo can pass a user's department, project, or other directory attribute through the SAML assertion, letting IAM roles authorize access only when that attribute matches a tag on the target resource. Once attributes for access control are enabled in Identity Center (and the role's trust policy allows sts:TagSession), Duo-supplied attributes, sent as https://aws.amazon.com/SAML/Attributes/AccessControl:<key>, become session tags that IAM policies can compare against resource tags.
Automating the AWS Access Lifecycle with SCIM
Authentication is only one half of the equation; the other is making sure the groups behind AAM's entitlements reflect who's actually on the team. Duo Directory can host your users directly or sit in front of your existing identity store, pulling users and groups in from Active Directory, Entra ID, or Google Workspace through directory sync, or from any SCIM-compliant directory you already run. From there, Duo's automated provisioning pushes the groups you choose into AWS IAM Identity Center, where an AWS administrator maps each one to specific IAM roles inside AAM. (The IAM roles themselves are still created in each account, by hand or with infrastructure as code.)
That single mapping step is reusable in a few different ways:
Group-driven access: Map a group such as AWS-Prod-Admins to its IAM role once, and every current and future member inherits that access automatically as SCIM syncs run—no per-user entitlement work required. From then on, adding or removing someone in Duo is the only step needed to grant or revoke that access.
Attribute-based access control: Pass a department, project, or environment attribute from Duo through Identity Center into an IAM role's policy conditions, so access depends on a directory attribute matching a resource tag rather than a static role assignment.
Pre-mapped groups for ongoing operations: Treat the group-to-role mapping as a standing pattern instead of a one-time setup, so adding or removing someone from a Duo group is the only action needed to grant or revoke their AWS access going forward.
Location and legal-entity segmentation: Sync a population defined by geography or legal entity, such as a Duo-EU-Users group, into its own Identity Center group, then scope AAM entitlements to only the accounts and roles that population should reach.
Deprovisioning works the same way in reverse: removing someone from the originating directory removes their AWS Identity Center user and group memberships on the next sync, so they can't start new AAM sessions, without anyone having to remember to revoke an IAM role manually. To limit how long existing sessions last, keep IAM role and Identity Center session durations short.
What This Means for IT Admins and CISOs
For IT administrators, this removes a recurring category of manual work: no more hand-building entitlements for every hire, transfer, or offboarding. Access changes happen where the organizational change already happens—in the directory—and AAM reflects it on the next sync cycle.
For CISOs, the benefit shows up in posture and evidence. MFA enforcement is uniform and centrally governed rather than configured per application. Access reviews have a clear, provable link between a user's current group membership and their AWS entitlements, provided entitlements are assigned to groups rather than individual users, which shortens the distance between "access was granted" and "access is still appropriate" that auditors look for.
Pairing Duo with AWS Account Access Manager turns a fragmented, manually maintained access model into one where access policies and authentication are enforced consistently and group membership, and therefore access, stays current on its own. Set the group-to-role mapping once, and Duo's lifecycle management keeps the membership behind it in sync from then on. If you're ready to setup and protect your AWS accounts and entitlements with Cisco Duo, check out our Admin Setup Guide – Configuring Cisco Duo with AWS IAM Account Access Manager.