Skip to main content
Users and access are declared in code. The fjall user verbs edit the identityCentre block of fjall/organisation/infrastructure.ts — they never call AWS directly. Changes take effect when you run fjall deploy organisation.

​
Overview

Your organisation’s users, groups, and memberships live in the identityCentre config of your organisation infrastructure file. The fjall user verbs are safe, reviewable file editors: they modify the declaration, you commit the diff, and the next organisation deploy makes AWS IAM Identity Center match it.
Because the verbs edit a local file, they need no AWS credentials and no login — authentication applies where it always did, at fjall deploy organisation. Only fjall user list --live and fjall user add --live touch AWS, read-only.

​
Identity source modes

The identityCentre config declares where user objects come from. The verbs adapt to the declared mode: See Users and Permissions for the config shapes and how to choose a mode.

​
Subcommands

​
Add a user or membership

In external mode, --first/--last are a hard error — your IdP owns user details. The default add is a pure file edit; pass --live to opt in to a preflight that checks the email is already synced into the identity store. After a successful write, the CLI offers to run the organisation deploy for you (identity-only organisation deploys typically take 2–5 minutes). Decline and the change simply waits in your working tree for review.

​
Remove a user or membership

​
List declared users

A pure file read — shows every declared user and membership, including membership-only entries (emails that appear in groups without a users entry), names, groups, and any expires stamps.
Adds live drift columns by querying the identity store read-only: whether each email is synced (in-store / not-synced) and any declared memberships that are not yet live in AWS (pending deploy, or stale after an IdP change). Requires organisation AWS credentials.

​
Re-resolve external users

Bumps resolutionVersion in the config so every email lookup re-resolves on the next deploy. Use this when your IdP deleted and recreated a user (the underlying user ID rotated) and memberships need to re-bind to the new ID.

​
Setting up an identity source

If your identity store isn’t set up yet, the verbs fail with a prescriptive error rather than a generic AWS one: For Google Workspace, the guided runbook walks the whole SAML + SCIM connection:

​
Default groups

Organisations deploy with three standard groups. Add custom groups and permission sets in the identityCentre config — see Users and Permissions. If a deploy finishes and every group is memberless, the deploy summary reminds you to declare access with fjall user add <email> --group <group>.

​
Common workflows

​
Onboard a teammate (external IdP)

Sarah signs in through your IdP; the deploy grants her group’s access across your accounts.

​
Grant a contractor time-boxed access

Past-expiry users still present in a membership fail the deploy at synth time, so expired access can’t silently persist.

​
Remove all access

​
Audit declared vs live access

​
Breaking change: SDK verbs removed

From fjall 2.24, the imperative verbs that wrote directly to AWS (user create, user destroy, user associate, user dissociate) are removed, along with the deprecated fjall user token alias. Their replacements: All replacements are file edits — follow each with fjall deploy organisation to apply.

​
Next steps

Users and Permissions

The identityCentre config: modes, groups, permission sets, memberships.

fjall token

Issue and manage agent tokens for CI/CD and automation.

fjall deploy

Apply declared changes with an organisation deploy.

Agent Mode

Drive these verbs from AI agents with structured output.