Improving Security Outcomes: Announcing AWS IAM account access manager

Sonrai Security Partners with AWS to launch Bring-Your-Own Role capabilities to AWS Accounts. 

We’re proud to announce that Sonrai Security is an AWS Launch Partner for AWS IAM account access manager (AAM), the newest addition to AWS’s identity and access management feature list. This joint collaboration extends critical security capabilities across our customers’ AWS organizations.

AAM gives organizations a direct way to grant workforce access to AWS accounts: map an AWS IAM Identity Center user or group to an IAM role you already own in the target account. There’s no intermediate policy to write and no generated role to adopt. You bring the roles your teams have built, often already managed as code, and IAM Identity Center federates your people into them. Users sign in to the familiar access portal, pick an account and role, and land in the console or pick up temporary credentials for the CLI.

The idea is simple: a who — an IAM Identity Center user or group — mapped to a what — a role in an account. It complements permission sets, where IAM Identity Center creates and provisions managed roles on your behalf, by adding a bring-your-own-role option.

Why this matters for AWS customers

AAM makes each individual grant simple. Governing what those grants open up is the real work. Every role that trusts the service is a potential path into an account, and in a bring-your-own-role model those paths multiply on their own as teams create new roles and pipelines stamp federation roles into freshly created accounts.

The feature is deliberately narrow: it defines the grant and leaves the governance of that grant to you. There’s no approval step, no clock on the access, no session to end. Once an entitlement exists, it’s standing access until someone removes it. The real question isn’t how do we create the mappings — AAM makes that simple. It’s how do we make sure people get access only when they should, through paths we know about and control.That’s what the Cloud Permissions Firewall was built for: the flexibility of AAM with SSO governance and just-in-time access built in.It makes it straightforward to ensure the only things granting access are the things that are supposed to — right down to declaring “if this role ever exists in any account, control it,” and having that hold as new accounts and new federation roles appear.

How the Sonrai Security Cloud Permissions Firewall extends AAM

The Cloud Permissions Firewall analyzes actual cloud activity, not theoretical policy, to determine what access is genuinely in use and what is simply sitting there as a possible risk. It then enforces least privilege through AWS’s own identity constructs, IAM Identity Center and IAM, so there is no proprietary agent, no proxy in the access path, and no shadow permission model to reconcile.

We extended our Just-in-Time access support to natively cover AAM with no new workflow. If a role can grant access through AAM, then Cloud Permissions Firewall finds it and governs it the same way it already governs the rest of your AWS access. For teams running the firewall today, the change is refreshingly small: those roles simply appear alongside your permission sets, ready to enroll.

With support for AAM, Sonrai Security customers can:

• See the full footprint before touching anything. The Cloud Permissions Firewall continuously discovers the roles across your organization that are wired for AAM, and shows which identities, workloads, and third parties are actually using access, so enforcement decisions are made on activity, not guesswork.
• Enroll AAM roles and permission sets from one place. They sit side by side in the same enrollment experience and inherit the same way: enroll at the organization or an OU and coverage flows down to every account beneath it, or enroll a single account when that’s the right scope.
• Replace standing access with on-demand access. An enrolled role is granted through Privileges-on-Demand: the first attempted use raises a request routed to Slack, Teams, or email, an approver grants it in minutes, and the requester keeps moving. Roles that warrant standing-but-governed access can be escalated to AutoPod instead.
• Deny by default. It’s the posture every security team wants, and Deny-first mode delivers it: the roles you’ve explicitly chosen are the only paths that grant access, and everything else is denied. When a new role capable of granting access appears anywhere in scope, it’s protected automatically, so an unintended path never opens.
• Get sessions, not grants. Every approval opens a time-boxed session with a length negotiated between requester and approver, capped by your organization’s maximum. When the session expires, or an administrator terminates it with one click, the access it granted is removed with it, and the full session history lands in the activity log for audit.

Customers running the Cloud Permissions Firewall today report a 92% reduction in privilege risk and 97% time savings on the path to least privilege. AAM extends that same model to a new layer of the AWS access surface.

Sonrai Security expands customer outcomes as a trusted AWS Identity Partner.

This newest launch expands Sonrai Security’s status as a trusted and leading partner to the AWS identity team. In December 2024, Sonrai was named an AWS Partner Network Launch Partner for Resource Control Policies (RCPs), shipping Third-Party Access Control to help customers enforce default-deny on external access the moment RCPs became available. Sonrai Security also has also completed integrations with AWS Control Tower and Amazon Bedrock, along with holding numerous AWS Competencies.

Customers drive what we do; as security needs change, we’re proud to continue to be a go-to identity partner with AWS to strengthen security practices for our joint customers. We will continue to identify new ways that AWS customers can put identity controls to work at enterprise scale and speed.

“We want to thank AWS for bringing AAM to IAM Identity Center. Our customers that federate through Okta and other identity providers have asked for just-in-time access and individual firewall controls for every person using a shared role. With AAM, those customers now get the same capabilities our customers using permission sets have relied on for years.”

— Sandy Bird, Cofounder and CTO, Sonrai Security

Get started

Getting started is straightforward. If your AWS Organization is already onboarded to the Cloud Permissions Firewall and using IAM Identity Center for workforce access, discovered AAM roles appear automatically alongside your permission sets in the Just-in-Time enrollment view. Nothing new to deploy.