AWS IAM Identity Center Multi-Region Replication Guide

When your identity provider goes down, everything stops. Engineers can't access production. Finance can't reach their dashboards. At GlobalTech Industries, a single-region IAM Identity Center configuration left 2,000 employees locked out during a 4-hour regional AWS incident. After that painful morning, they implemented multi-region replication—ensuring workforce access survives even complete regional failures.

AWS IAM Identity Center now supports multi-region replication, allowing you to replicate workforce identities, permission sets, and metadata across multiple AWS regions. This guide walks through implementing multi-region replication for improved resiliency, better user experience for globally distributed teams, and compliance with data residency requirements.

Understanding Multi-Region Identity Replication

Before diving into implementation, let's understand what gets replicated and how it works:

Prerequisites for Multi-Region Replication

Before enabling multi-region support, ensure your environment meets these requirements:

Step 1: Create a Multi-Region KMS Key

Multi-region replication requires a customer managed KMS key that can be replicated to target regions. Here's how to create one:

Using AWS CLI

# Create multi-region primary KMS key
aws kms create-key \
    --description "IAM Identity Center Multi-Region Key" \
    --multi-region \
    --region us-east-1

# Note the KeyId from the output, then create replica in target region
aws kms replicate-key \
    --key-id arn:aws:kms:us-east-1:123456789012:key/mrk-1234abcd \
    --replica-region eu-west-1

# Create alias for easier management
aws kms create-alias \
    --alias-name alias/identity-center-key \
    --target-key-id mrk-1234abcd \
    --region us-east-1

KMS Key Policy for IAM Identity Center

The KMS key requires specific permissions for IAM Identity Center operations. Add this policy to your key:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowIAMIdentityCenterAccess",
      "Effect": "Allow",
      "Principal": {
        "Service": "sso.amazonaws.com"
      },
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey*",
        "kms:DescribeKey",
        "kms:CreateGrant"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:sso:::instance/*"
        }
      }
    },
    {
      "Sid": "AllowKeyAdministration",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}

Step 2: Enable Multi-Region Replication in IAM Identity Center

With your multi-region KMS key ready, you can now add additional regions to IAM Identity Center:

1. Access IAM Identity Center Console: Navigate to your primary region (e.g., us-east-1)
2. Open Settings: Click Settings in the left navigation
3. Select Management Tab: Verify your encryption key is a multi-region customer managed KMS key
4. Add Region: Click Add Region to start the replication wizard
5. Choose Target Region: Select the region where you want to replicate (e.g., eu-west-1)
6. Confirm Replication: Review settings and click Add Region

Step 3: Configure Your Identity Provider

After replication completes, you need to configure your external IdP to support the new region's access portal. Each region has its own Assertion Consumer Service (ACS) URL.

Getting ACS URLs

View SAML information for all regions:

# Primary Region ACS URL (example)
https://us-east-1.signin.aws.amazon.com/saml

# Additional Region ACS URL (example)
https://eu-west-1.signin.aws.amazon.com/saml

# Access Portal URLs
# Primary: https://d-1234567890.awsapps.com/start
# Additional: https://d-1234567890.awsapps.com/start?region=eu-west-1

Configuring Okta for Multi-Region

In your Okta admin console, add the additional region's ACS URL:

1. Navigate to Applications → AWS IAM Identity Center
2. Go to Sign On tab → SAML Settings
3. Click Edit and add the new ACS URL to the allowed reply URLs
4. Save changes

Configuring Microsoft Entra ID

For Microsoft Entra ID (Azure AD), add the additional reply URL:

1. Go to Enterprise Applications → AWS IAM Identity Center
2. Select Single sign-on → SAML
3. Click Edit on Basic SAML Configuration
4. Add the additional region's ACS URL under Reply URL
5. Save configuration

Step 4: Create Regional Bookmark Applications

Help users discover the additional region by creating bookmark applications in your IdP:

# Bookmark Application URLs for User Portal

# Primary Region (US East)
Name: AWS Access Portal (US)
URL: https://d-1234567890.awsapps.com/start

# Additional Region (EU West)
Name: AWS Access Portal (EU)
URL: https://d-1234567890.awsapps.com/start?region=eu-west-1

# Additional Region (Asia Pacific)
Name: AWS Access Portal (APAC)
URL: https://d-1234567890.awsapps.com/start?region=ap-southeast-1

Step 5: Verify Replication Status

Monitor replication status and verify everything is working correctly:

Check Replication Status via CLI

# List all regions where Identity Center is enabled
aws sso-admin list-instances --region us-east-1

# Check instance details
aws sso-admin describe-instance \
    --instance-arn arn:aws:sso:::instance/ssoins-1234567890abcdef \
    --region us-east-1

# Verify users are replicated (check in additional region)
aws identitystore list-users \
    --identity-store-id d-1234567890 \
    --region eu-west-1

Operational Considerations

Understanding how multi-region IAM Identity Center operates is crucial for day-to-day management:

Monitoring with CloudTrail

All workforce actions emit CloudTrail events in the region where they occur. Set up centralized logging for complete visibility:

# Create organization trail for multi-region events
aws cloudtrail create-trail \
    --name identity-center-audit \
    --s3-bucket-name my-cloudtrail-logs \
    --is-multi-region-trail \
    --is-organization-trail \
    --include-global-service-events

# Enable logging
aws cloudtrail start-logging \
    --name identity-center-audit

# Example CloudWatch Insights query for SSO events
fields @timestamp, eventName, userIdentity.arn, awsRegion
| filter eventSource = "sso.amazonaws.com"
| sort @timestamp desc
| limit 100

Disaster Recovery Architecture

With multi-region replication, your workforce has automatic failover capability. Here's how to document your DR procedures:

Frequently Asked Questions

Conclusion

Multi-region replication for AWS IAM Identity Center transforms your identity infrastructure from a single point of failure into a resilient, globally distributed system. Your workforce can continue accessing AWS accounts even during regional outages, applications authenticate users locally for better performance, and you can meet data residency requirements without compromising centralized identity management.

The implementation is straightforward: create a multi-region KMS key, add regions through the console, and update your IdP configuration. There's no additional cost beyond standard KMS charges, and you maintain full control from your primary region. For organizations running critical workloads on AWS, multi-region identity replication should be a standard part of your resilience architecture.