Connect AWS IAM Identity Center to Gateco

This guide walks you through connecting AWS IAM Identity Center to Gateco so that your AWS users and groups become available as principals for identity-aware retrieval policies. Once synced, you can write RAG access control rules like "allow members of the engineering group to retrieve documents classified as internal" — enforcing identity-based access at the retrieval layer without any custom logic in your application.

Step 1 — Enable IAM Identity Center

IAM Identity Center must be enabled in your AWS Organization before you can create an Identity Store.

1. Open the AWS Console and navigate to IAM Identity Center (search "Identity Center" in the top bar).
2. If prompted, click Enable. This takes about 30 seconds.
3. Once enabled, go to Settings. Note the Identity Store ID — it looks like d-90660f8614.
4. Also note the Region where Identity Center is enabled (e.g. us-east-1).

Step 2 — Create an IAM user for Gateco

Create a dedicated IAM user that Gateco will use to read your Identity Store. Keeping this separate from other service accounts makes it easier to audit and rotate credentials.

1. Navigate to IAM → Users → Create user.
2. Username: gateco-idp-reader (or any name meaningful to your org).
3. On the permissions screen, choose "Attach policies directly" — leave all checkboxes empty for now.
4. Finish creating the user.
5. Go to the user → Security credentials → Create access key.
6. Use case: "Application running outside AWS". Click Next.
7. Copy both the Access Key ID and Secret Access Key immediately — the secret is shown only once.

Step 3 — Attach the Identity Store read policy

Attach an inline policy with the minimum permissions Gateco needs.

1. Open the IAM user you created → Add permissions → Create inline policy.
2. Switch to the JSON editor and paste the policy below.
3. Name the policy gateco-idp-read and save.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "identitystore:ListUsers",
        "identitystore:ListGroups",
        "identitystore:ListGroupMemberships",
        "identitystore:DescribeUser",
        "identitystore:DescribeGroup"
      ],
      "Resource": "*"
    }
  ]
}

Step 4 — Get your Identity Store ID

You already noted this in Step 1, but here is where to find it if you need it again:

1. Navigate to IAM Identity Center → Settings.
2. Under "Identity source", copy the Identity store ID (format d-xxxxxxxxxx).

Step 5 — Add credentials to Gateco

In the Gateco dashboard:

1. Navigate to Identity Providers → Add provider.
2. Select AWS IAM Identity Center.
3. Enter the values from the table below.
4. Click Test connection. Gateco will display the number of users and groups it can read.
5. Click Save.

Step 6 — Trigger initial sync

After saving the provider, click Sync now. Gateco will:

1. List all users from the Identity Store.
2. List all groups and their memberships.
3. Create Principal records for each user.
4. Populate group assignments and department attributes.

Once synced, principals appear in the Principals list and are available for use in policy conditions (principal.groups, principal.attributes.department, etc.).

Configuration reference

Troubleshooting