> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/configure-iam-security/integrate-prisma-cloud-with-aws-id-center.md).

# Integrate Prisma Cloud with AWS IAM Identity Center

To provide effective permissions calculation in the IAM Security module, Prisma Cloud integrates with the Identity Provider (IdP) service, AWS IAM Identity Center, to ingest Single Sign-On (SSO) data. Complete this integration to gain better visibility into the entities accessing your cloud resources, by using the IAM query to list effective permissions of AWS IAM Identity Center users across your cloud accounts.

Prisma Cloud requires the following additional permissions to support AWS IAM Identity Center integration:

* screen:\[sso:ListInstances]
* screen:\[sso:ListPermissionSets]
* screen:\[sso:ListAccountForProvisionedPermissionSet]
* screen:\[sso:ListAccountAssignments]
* screen:\[sso:DescribePermissionSets]
* screen:\[identitystore:ListUsers]
* screen:\[identitystore:ListGroupMemberships]
* screen:\[identitystore:ListGroups]

If you are using a CloudFormation template for AWS account onboarding no additional action is required. The required permissions are part of the CloudFormation onboarding template.

## **Adding Required Permissions for Existing Accounts**

To [Update an Onboarded AWS account](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/connect-your-cloud-platform-to-prisma-cloud/onboard-aws/update-aws-account), and add the required permissions, rerun the last updated version of the CloudFormation template for the respective AWS account.

Optionally, you can also follow the steps to [manually](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/connect-your-cloud-platform-to-prisma-cloud/onboard-aws/manually-set-up-prisma-cloud-role-for-aws) add these permissions to the role assumed by the Prisma Cloud user.

## **Run IAM Queries**

After AWS IAM Identity Center is integrated with Prisma Cloud, you can view the results of IAM queries for the AWS IAM Identity Center and gain visibility and governance into your cloud environment. Follow the steps below to run IAM queries for AWS IAM Identity Center:

1. From the Prisma Cloud console, click **Investigate**.
2. Enter the following RQL query on the Investigate tab.

   ```
   config from iam where source.idp.service = 'AWS Identity Center'
   ```
3. The query will return a list of all the AWS IAM Identity Center users in your cloud account.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/configure-iam-security/integrate-prisma-cloud-with-aws-id-center.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.