---
title: IAM Identity Center
description: Sign in to an Identity Center portal and get every account and role you can reach.
---

An Identity Center integration is one portal start URL. rolle signs in through your browser (OIDC authorization code with PKCE, returning to a loopback port) and lists every account and permission set your user can reach. Each pair becomes a session named `Account/Role`.

```sh
rolle integration add aws-sso --alias acme --start-url https://acme.awsapps.com/start --region us-east-1
rolle integration login acme            # opens the browser
rolle integration login acme --no-browser   # device code, for terminals without a browser
rolle integration sync acme             # rediscover accounts and roles
rolle integration logout acme           # sign out and stop its sessions
```

| Flag | Meaning |
| --- | --- |
| `--alias` | Short name for the portal |
| `--start-url` | Portal start URL |
| `--region` | Region that hosts the portal |

## Sessions from a portal

Roles group under their account in the desktop app. Sync adds new roles and removes roles you can no longer reach. A started role calls `GetRoleCredentials` and renews on its own while the portal sign-in is valid.

The credential lifetime is the permission set's session duration, set by your Identity Center administrator (often 1 to 12 hours). The **Assume role duration** setting does not apply here; it covers [chained assume-role sessions](/aws/assume-role).

## Import

rolle imports portals from the AWS CLI config (`sso-session` and legacy `sso_start_url` sections) and from Granted profiles. If the AWS CLI already holds a valid token for a portal, rolle reuses it and you do not sign in again.