LAB 12: AWS IAM Identity Center (SSO)

Navigate to: IAM Identity Center (Search "IAM Identity Center" or "SSO") If using AWS Organizations: → Click "Enable" Identity Center is enabled in ONE region only. Choose your primary region (e.g., us-east-1). After enabling: - User portal URL created automatically - Identity source defaults to Identity Center directory Note your User Portal URL: https://d-xxxxxxxxxx.awsapps.com/start (Customize this later)

Navigate to: Settings → Identity source Options: 1. Identity Center directory (default) - Built-in directory, good for small teams - Manual user/group management 2. Active Directory - AWS Managed AD or AD Connector - Sync users from on-prem AD 3. External identity provider - Okta, Azure AD, Google Workspace, etc. - SAML 2.0 + SCIM for provisioning For this lab, use Identity Center directory. (Module 5 covers external IdP integration)

Navigate to: Settings → Authentication MFA Settings: - MFA prompt: Every time they sign in OR: Only when sign-in context changes (risk-based) - Users can use these MFA types: ✓ Authenticator apps ✓ Security keys (FIDO2) ✓ Built-in authenticators (Touch ID, Windows Hello) - If user doesn't have MFA registered: → Require them to register at sign in - Who can manage MFA devices: → Users can add/remove their own → Click "Save changes"

Navigate to: Settings → Access portal Customize URL: → Click "Customize" → Enter: yourcompany → New URL: https://yourcompany.awsapps.com/start Portal branding (optional): - Upload company logo - Customize display name Session settings: → Click "Session settings" - Session duration: 8 hours (default 1 hour) (How long portal session lasts) → Save all settings

Navigate to: Groups → Create group Create job-function groups: Group 1: - Group name: Platform-Admins - Description: Full admin access to all accounts → Create group Group 2: - Group name: Developers - Description: Developer access to dev/staging → Create group Group 3: - Group name: Operations - Description: Read + monitoring access → Create group Group 4: - Group name: Security-Auditors - Description: Read-only security audit access → Create group Best practice: Assign permissions to groups, not users!

Navigate to: Users → Add user User 1 (Platform Admin): - Username: alice - Email: alice@yourcompany.com - First name: Alice - Last name: Admin - Display name: Alice Admin - Generate one-time password: Yes → Add user User 2 (Developer): - Username: bob - Email: bob@yourcompany.com - First name: Bob - Last name: Developer → Add user User 3 (Operations): - Username: carol - Email: carol@yourcompany.com - First name: Carol - Last name: Ops → Add user Users receive email with portal URL and temporary password.

Navigate to: Groups → Platform-Admins → Add users → Select: alice → Add users Navigate to: Groups → Developers → Add users → Select: bob → Add users Navigate to: Groups → Operations → Add users → Select: carol → Add users Verify memberships: Navigate to: Users → [user] → Groups tab Shows all groups user belongs to.

# Get Identity Store ID INSTANCE_ARN=$(aws sso-admin list-instances \ --query 'Instances[0].InstanceArn' --output text) IDENTITY_STORE_ID=$(aws sso-admin list-instances \ --query 'Instances[0].IdentityStoreId' --output text) # List users aws identitystore list-users \ --identity-store-id $IDENTITY_STORE_ID # List groups aws identitystore list-groups \ --identity-store-id $IDENTITY_STORE_ID # Create user via CLI aws identitystore create-user \ --identity-store-id $IDENTITY_STORE_ID \ --user-name "dave" \ --display-name "Dave DevOps" \ --name '{"FamilyName":"DevOps","GivenName":"Dave"}' \ --emails '[{"Value":"dave@company.com","Primary":true}]'

Navigate to: Permission sets → Create permission set Permission set type: → Select "Predefined permission set" → Select: AdministratorAccess → Next Specify details: - Permission set name: AdministratorAccess - Description: Full admin access - Session duration: 4 hours - Relay state: (leave blank) → Next Review and create Repeat for: - ReadOnlyAccess - PowerUserAccess - ViewOnlyAccess

Navigate to: Permission sets → Create permission set Permission set type: → Select "Custom permission set" → Next Specify policies: → Select "Inline policy" Paste this policy:

{ "Version": "2012-10-17", "Statement": [ { "Sid": "DeveloperEC2", "Effect": "Allow", "Action": [ "ec2:*" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:ResourceTag/Environment": "Development" } } }, { "Sid": "DeveloperS3", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::dev-*", "arn:aws:s3:::dev-*/*" ] }, { "Sid": "DeveloperLambda", "Effect": "Allow", "Action": [ "lambda:*" ], "Resource": "arn:aws:lambda:*:*:function:dev-*" }, { "Sid": "ReadCloudWatch", "Effect": "Allow", "Action": [ "cloudwatch:Get*", "cloudwatch:List*", "logs:Get*", "logs:Describe*" ], "Resource": "*" } ] }

Permission set details: - Name: DeveloperAccess-Custom - Description: Restricted developer access for dev resources - Session duration: 8 hours → Create permission set

Navigate to: Permission sets → DeveloperAccess-Custom → Edit Scroll to: Permission boundary Add AWS managed policy as boundary: → Select: PowerUserAccess This ensures even if inline policy is overly permissive, the permission boundary limits effective permissions. → Save changes

# Get SSO instance ARN INSTANCE_ARN=$(aws sso-admin list-instances \ --query 'Instances[0].InstanceArn' --output text) # Create permission set aws sso-admin create-permission-set \ --instance-arn $INSTANCE_ARN \ --name "SecurityAuditor" \ --description "Security audit read-only access" \ --session-duration "PT4H" # Get permission set ARN PS_ARN=$(aws sso-admin list-permission-sets \ --instance-arn $INSTANCE_ARN \ --query "PermissionSets[?ends_with(@, 'SecurityAuditor')]" \ --output text) # Attach managed policy aws sso-admin attach-managed-policy-to-permission-set \ --instance-arn $INSTANCE_ARN \ --permission-set-arn $PS_ARN \ --managed-policy-arn "arn:aws:iam::aws:policy/SecurityAudit"

Navigate to: Permission sets You should have: - AdministratorAccess (AWS managed) - PowerUserAccess (AWS managed) - ReadOnlyAccess (AWS managed) - DeveloperAccess-Custom (Custom) - SecurityAuditor (Custom) Each shows: - Type (AWS managed vs Custom) - Session duration - Number of accounts assigned

Navigate to: AWS accounts Select account(s): → Check: Management Account → Click "Assign users or groups" Select users/groups: → Click "Groups" tab → Select: Platform-Admins → Next Select permission sets: → Select: AdministratorAccess → Next Review and submit: → Submit Platform-Admins group now has AdministratorAccess to the Management Account!

Create assignments for your organization: Developers group: - Workload-Dev account → DeveloperAccess-Custom - Workload-Dev account → ReadOnlyAccess (for viewing) - Workload-Staging account → ReadOnlyAccess Operations group: - All workload accounts → ReadOnlyAccess - All workload accounts → CloudWatchFullAccess (if created) Security-Auditors group: - All accounts → SecurityAuditor - Log-Archive account → ReadOnlyAccess Platform-Admins group: - All accounts → AdministratorAccess Repeat the assignment process for each combination.

# Variables INSTANCE_ARN=$(aws sso-admin list-instances \ --query 'Instances[0].InstanceArn' --output text) IDENTITY_STORE_ID=$(aws sso-admin list-instances \ --query 'Instances[0].IdentityStoreId' --output text) # Get group ID GROUP_ID=$(aws identitystore list-groups \ --identity-store-id $IDENTITY_STORE_ID \ --query "Groups[?DisplayName=='Developers'].GroupId" \ --output text) # Get permission set ARN PS_ARN=$(aws sso-admin list-permission-sets \ --instance-arn $INSTANCE_ARN \ --query "PermissionSets[0]" --output text) # Create account assignment TARGET_ACCOUNT_ID="123456789012" aws sso-admin create-account-assignment \ --instance-arn $INSTANCE_ARN \ --target-id $TARGET_ACCOUNT_ID \ --target-type AWS_ACCOUNT \ --permission-set-arn $PS_ARN \ --principal-type GROUP \ --principal-id $GROUP_ID

Sign in as a user: Navigate to: https://yourcompany.awsapps.com/start Enter username: bob Enter password: [from email] Complete MFA setup (first login) User portal shows: - All AWS accounts bob has access to - Permission sets available per account Click on account: → Shows available permission sets → Click "Management console" to federate in → Or click "Command line or programmatic access" for temporary credentials User is now signed into AWS Console with the selected permission set!

Navigate to: Settings → Identity source → Actions → Change identity source ⚠️ WARNING: Changing identity source deletes all users, groups, and assignments. Export/document first! Select: External identity provider → Next Download metadata: - AWS SSO SAML metadata file - Or copy individual values: - AWS SSO Sign-in URL - AWS SSO ACS URL - AWS SSO Issuer URL You'll configure these in your IdP.

In Azure AD (Entra ID): 1. Add Enterprise Application: → Azure AD → Enterprise applications → New → Search "AWS IAM Identity Center" → Add 2. Configure SAML: → Single sign-on → SAML → Edit Basic SAML Configuration: - Identifier: [AWS SSO Issuer URL] - Reply URL: [AWS SSO ACS URL] - Sign on URL: [AWS SSO Sign-in URL] 3. Download Azure AD metadata: → Federation Metadata XML → Download 4. Configure Provisioning (SCIM): → Provisioning → Get started → Mode: Automatic - Tenant URL: [SCIM endpoint from AWS] - Secret Token: [SCIM token from AWS] → Test connection → Save → Enable provisioning

Back in AWS IAM Identity Center: Identity provider metadata: → Upload: [IdP metadata XML file] → Or enter manually: - IdP sign-in URL - IdP issuer URL - IdP certificate → Next Enable automatic provisioning (SCIM): → Enable → Note the SCIM endpoint URL → Generate access token (copy immediately!) → Complete setup Users/groups now sync from external IdP!

Navigate to: Settings → Attributes for access control Map IdP attributes to AWS session tags: → Add attribute Example mappings: - Key: Department Value: ${path:enterprise.department} - Key: CostCenter Value: ${path:enterprise.costCenter} - Key: Team Value: ${path:custom.team} These become session tags in AWS, usable in policies: "Condition": { "StringEquals": { "aws:PrincipalTag/Department": "Engineering" } }

Test the integration: Option 1: IdP-initiated login - Go to IdP app portal (Azure MyApps, Okta dashboard) - Click AWS IAM Identity Center app - Redirected to AWS SSO portal Option 2: SP-initiated login - Go to: https://yourcompany.awsapps.com/start - Click "Sign in with your corporate ID" - Redirected to IdP for authentication - After auth, returned to AWS portal Verify: - User sees their assigned accounts - Groups synced correctly from IdP - Assignments work as expected

# Configure SSO profile aws configure sso # Prompts: # SSO session name: my-sso # SSO start URL: https://yourcompany.awsapps.com/start # SSO region: us-east-1 # SSO registration scopes: sso:account:access # Browser opens for authentication # After auth, select account and permission set # CLI profile name: dev-account # This creates ~/.aws/config entry: [profile dev-account] sso_session = my-sso sso_account_id = 123456789012 sso_role_name = DeveloperAccess-Custom region = us-east-1 [sso-session my-sso] sso_start_url = https://yourcompany.awsapps.com/start sso_region = us-east-1 sso_registration_scopes = sso:account:access

# Login to SSO (opens browser) aws sso login --profile dev-account # Or login to session (access all profiles) aws sso login --sso-session my-sso # Use the profile aws s3 ls --profile dev-account aws ec2 describe-instances --profile dev-account # Set as default profile export AWS_PROFILE=dev-account # Now commands use SSO credentials automatically aws sts get-caller-identity # Credentials are cached and auto-refresh # When they expire, you'll be prompted to re-authenticate

From user portal, get credentials for scripts: 1. Login to: https://yourcompany.awsapps.com/start 2. Click on account 3. Click "Command line or programmatic access" Options shown: - Option 1: Set environment variables export AWS_ACCESS_KEY_ID="ASIA..." export AWS_SECRET_ACCESS_KEY="..." export AWS_SESSION_TOKEN="..." - Option 2: Add to credentials file [123456789012_DeveloperAccess] aws_access_key_id=ASIA... - Option 3: Use with --profile These are temporary credentials (match session duration).

# Add multiple profiles to ~/.aws/config [sso-session my-sso] sso_start_url = https://yourcompany.awsapps.com/start sso_region = us-east-1 sso_registration_scopes = sso:account:access [profile dev-admin] sso_session = my-sso sso_account_id = 111111111111 sso_role_name = AdministratorAccess region = us-east-1 [profile dev-developer] sso_session = my-sso sso_account_id = 111111111111 sso_role_name = DeveloperAccess-Custom region = us-east-1 [profile prod-readonly] sso_session = my-sso sso_account_id = 222222222222 sso_role_name = ReadOnlyAccess region = us-east-1 [profile prod-admin] sso_session = my-sso sso_account_id = 222222222222 sso_role_name = AdministratorAccess region = us-east-1 # Single login provides access to all profiles! aws sso login --sso-session my-sso # Switch between profiles easily aws s3 ls --profile dev-developer aws s3 ls --profile prod-readonly

Navigate to: Applications → Add application Application type: → Select "I have an application I want to set up" → Select "Application type: SAML 2.0" → Next Application metadata: - Display name: Internal HR Portal - Description: Company HR system SAML configuration: - Application ACS URL: https://hr.company.com/saml/acs - Application SAML audience: https://hr.company.com → Submit Download AWS SSO metadata for the HR app to configure on the HR portal side.

Navigate to: Applications → Internal HR Portal → Assign users and groups Select groups: → Check: All-Employees (or relevant group) → Save All users in the group now see this app in their SSO portal alongside AWS accounts.

Navigate to: Applications → Add application → Select "Add from application catalog" Search catalog for pre-integrated apps: - Salesforce - Slack - Zoom - ServiceNow - Jira - Confluence - GitHub - Many more... Select application: → Follow guided setup → AWS provides pre-configured settings → Copy metadata to target application → Assign users/groups Users get SSO access to both AWS accounts AND business applications from single portal!