AWS SSO - List users assigned with an aws account

[BSouzaDock]

I have the list of all AWS accounts in my organization. I need to list the users present in each account via API.

Through the documentation List account assigments, I can list only passing as parameters account + permission set. I wanted it to list all users, just like when I click on the account via console, as shown in the image:

The method reported above without the permission set parameter would solve the problem, but it is REQUIRED.
Can anyone tell me if this is possible?

[RyanFitzSimmonsAK]

Hi @BSouzaDock, thanks for reaching out. Listing the users associated with an AWS account is a feature in Identity Store, the successor to SSO. Switching to Identity Center and using list_users should accomplish what you're trying to do here. Please let me know if you have any other questions.

[BSouzaDock]

Hi @RyanFitzSimmonsAK, thanks for the answer.

It turns out that this method lists all IDP users, but no attribute option that tells which account you want to list from. This makes the process very slow. The only way I could do to list as in the image was as follows:

1. List all organization accounts
2. For each account, list all permission sets
3. With the account id and permission set, you can list users
4. Group the users found in each aws account.

It would be interesting to have a ssoacountid parameter in the method of listing users, so I could do it more objectively.

[RyanFitzSimmonsAK]

I can definitely see why you'd prefer a simpler process. I've reached out to the service team to ask if this is something currently possible, or if it's something they'd consider implementing. I'll update you when I hear back.