Securing Workforce Access at Scale Using AWS IAM Identity Center with Xylem

Founded in 2011, Xylem provides smart water solutions—from water meters to leak detection services—to utility companies and other customers in 150 countries. When Xylem began to provide operational security controls across its cloud products, it discovered that identity credentials were not uniform across its 140 AWS accounts. When team members shifted roles, they needed to gain access to other accounts. To create a common identity and access framework enforceable across the company and its AWS accounts, Xylem decided to use AWS IAM Identity Center. “We have a consistent identity solution that we manage within any group, we’re able to audit access, and we can enforce consistent identity policies, multifactor authentication, password complexity and password rotation, and on and on,” says Josh Jacobs, senior manager for global security operations at Xylem. “We’re able to do a lot with limited resources.”

The company began migrating workforce identities to AWS IAM Identity Center in 2021. These identities include the company’s data lake team, one of its most security-conscious development teams. The migration is going smoothly, with no downtime for Xylem products. The company also uses AWS Security Hub to automate AWS security checks and centralize security alerts. Xylem uses it to monitor data and security 24/7, improving its security posture.

Xylem has sped up the onboarding of new employees to AWS; their identities are set up before they begin working, instead of days later. “Everybody at Xylem has an identity, and if they shift into a role where they will be using AWS, it’s essentially zero time to get the identity piece of that added,” says Jacobs. This improvement in identity management and access controls helps employees develop products faster, resulting in better time to market.

By using AWS IAM Identity Center, Xylem can provide workforce access at scale as it continues to accelerate cloud adoption and innovate solutions for customers. New business acquisitions can be assimilated into workforce access while consistently applying policies across multiple AWS accounts.

Xylem has already migrated 15 products to the new solution and plans to have the process completed by early 2023. After that, the company plans to operationalize this approach to identities and use it for more AWS services. “The only way we’re going to keep building and growing as a company is to strengthen identity as our foundation, and that’s exactly what we did using AWS,” says Jacobs.