AWS Security Blog

Tag: AWS SSO

Build a strong identity foundation that uses your existing on-premises Active Directory

This blog post outlines how to use your existing Microsoft Active Directory (AD) to reliably authenticate access to your Amazon Web Services (AWS) accounts, infrastructure running on AWS, and third-party applications. The architecture we describe is designed to be highly available and extends access to your existing AD to AWS, enabling your users to use […]

Read More

Getting started with AWS SSO delegated administration

May 23, 2022: AWS SSO supports two forms of delegation. One form, which is covered in this blog, is to delegate a member account where you can administer the service, which eliminates the requirement to sign in to the AWS Organizations management account for daily administrative work. The second form is delegating which people can […]

Read More
Figure 1: Solution architecture diagram

Configure AWS SSO ABAC for EC2 instances and Systems Manager Session Manager

In this blog post, I show you how to configure AWS Single Sign-On to define attribute-based access control (ABAC) permissions to manage Amazon Elastic Compute Cloud (Amazon EC2) instances and AWS Systems Manager Session Manager for federated users. This combination allows you to control access to specific Amazon EC2 instances based on users’ attributes. I show […]

Read More

How to enable secure seamless single sign-on to Amazon EC2 Windows instances with AWS SSO

Today, we’re launching new functionality that simplifies the experience to securely access your AWS compute instances running Microsoft Windows. We took on this update to respond to customer feedback around creating a more streamlined experience for administrators and users to more securely access their EC2 Windows instances. The new experience utilizes your existing identity solutions […]

Read More

Build an end-to-end attribute-based access control strategy with AWS SSO and Okta

This blog post discusses the benefits of using an attribute-based access control (ABAC) strategy and also describes how to use ABAC with AWS Single Sign-On (AWS SSO) when you’re using Okta as an identity provider (IdP). Over the past two years, Amazon Web Services (AWS) has invested heavily in making ABAC available across the majority […]

Read More

Highlights from the latest AWS Identity launches

Here is the latest from AWS Identity from November 2020 through February 2021. The features highlighted in this blog post can help you manage and secure your Amazon Web Services (AWS) environment. Identity services answer the question of who has access to what. They enable you to securely manage identities, resources, and permissions at scale and […]

Read More

How AWS SSO Active Directory sync enhances AWS application experiences

Identity management is easiest when you can manage identities in a centralized location and use these identities across various accounts and applications. You also want to be able to use these identities for other purposes within applications, like searching through groups, finding members of a certain group, and sharing projects with other users or groups. […]

Read More

Use new account assignment APIs for AWS SSO to automate multi-account access

February 18, 2021: We updated the name of the organization management account used in the example. The new name is ExampleOrgManagement. February 10, 2021: We updated the commands in the Cleanup section of this post. In this blog post, we’ll show how you can programmatically assign and audit access to multiple AWS accounts for your […]

Read More

How to bulk import users and groups from CSV into AWS SSO

When you connect an external identity provider (IdP) to AWS Single Sign-On (SSO) using Security Assertion Markup Language (SAML) 2.0 standard, you must create all users and groups into AWS SSO before you can make any assignments to AWS accounts or applications. If your IdP supports user and group provisioning by way of the System […]

Read More

On-Demand SCIM provisioning of Azure AD to AWS SSO with PowerShell

February 14, 2022: We updated this post to include a link to an updated version of this solution in the Prerequisites section. July 6, 2021: We updated this post to remove the user requirement to trigger the API endpoint because authentication is performed by application permissions. January 8, 2021: We updated this post to reflect […]

Read More