Federated Access With Okta
Objective: Configure AWS IAM Identity Center (AWS SSO) with Okta to enable federated login to AWS using Okta as the Identity Provider (IdP). 🔹 Outcome: Users will log in to AWS using Okta credentials instead of IAM Users, and IAM Identity Center will dynamically assign IAM Roles.
📌 Prerequisites
✅ AWS IAM Identity Center (AWS SSO) is enabled in your AWS account. ✅ Okta Admin access (to configure the enterprise app). ✅ AWS Organizations is set up (for multi-account management).
🛠️ Step 1: Enable IAM Identity Center in AWS
📌 Go to IAM Identity Center Console 1️⃣ Navigate to AWS Console → IAM Identity Center. 2️⃣ Click Enable IAM Identity Center (if not already enabled). 3️⃣ Select "Use an external identity provider (IdP)". 4️⃣ Copy the IAM Identity Center SAML Metadata URL – needed for Okta configuration.
✅ IAM Identity Center is now ready for federation with Okta.
🛠️ Step 2: Configure Okta as the Identity Provider for AWS
📌 Set Up AWS IAM Identity Center in Okta
1️⃣ Log in to the Okta Admin Console (https://admin.okta.com).
2️⃣ Navigate to Applications → Click Create App Integration.
3️⃣ Select SAML 2.0 as the Sign-on method.
4️⃣ Enter "AWS IAM Identity Center" as the app name.
5️⃣ Click Next.
📌 Configure SAML Settings in Okta
6️⃣ Single sign-on URL: Paste the IAM Identity Center SAML Metadata URL copied from AWS.
7️⃣ Audience URI (SP Entity ID): Enter urn:amazon:webservices.
8️⃣ Name ID format: EmailAddress.
9️⃣ Click Next → Save Configuration.
🔟 Download the Okta Metadata XML File.
✅ Okta is now configured to authenticate AWS users.
🛠️ Step 3: Configure IAM Identity Center to Use Okta
📌 Import Okta Metadata into AWS 1️⃣ Navigate back to AWS IAM Identity Center → Settings → Identity Source. 2️⃣ Click Change Identity Source. 3️⃣ Select SAML 2.0-based authentication. 4️⃣ Upload the Okta Metadata XML file downloaded earlier. 5️⃣ Click Next, review the settings, and Accept Change.
✅ IAM Identity Center is now linked to Okta!
🛠️ Step 4: Sync Okta Groups with AWS IAM Identity Center
📌 Create Groups in Okta 1️⃣ In Okta, go to Directory → Groups → Create Group. 2️⃣ Create a group SecureCart-Developers. 3️⃣ Add developers to this group who need AWS access.
📌 Assign Groups in AWS IAM Identity Center
1️⃣ Go to AWS Console → IAM Identity Center → AWS Accounts.
2️⃣ Select the AWS Account you want to grant access to.
3️⃣ Click Assign Users & Groups.
4️⃣ Choose Okta Groups (e.g., SecureCart-Developers).
5️⃣ Select a Permission Set (e.g., AdministratorAccess, ReadOnlyAccess).
6️⃣ Click Save.
✅ Users in the Okta group can now assume IAM Roles dynamically.
🛠️ Step 5: Test AWS Login Using Okta Credentials
📌 Test User Login 1️⃣ Open the IAM Identity Center User Portal URL (https://securecart.awsapps.com/start).
2️⃣ Click Sign in with Okta.
3️⃣ Enter Okta username & password.
4️⃣ After authentication, users can see assigned AWS accounts.
5️⃣ Click an account → Assume the assigned IAM Role.
✅ Users now authenticate using Okta and access AWS resources securely!
📌 🎯 Bonus: AWS CLI Authentication with Okta & SSO
✅ Developers can authenticate to AWS CLI using Okta credentials.
📌 Result: Users authenticate via Okta and assume an IAM Role without needing IAM credentials.
📌 Summary of Setup
Step
Action
Step 1
Enable IAM Identity Center in AWS
Step 2
Set up AWS IAM Identity Center in Okta
Step 3
Link IAM Identity Center with Okta
Step 4
Map Okta Groups to AWS IAM Roles
Step 5
Test AWS Login with Okta Credentials
Bonus
Enable AWS CLI authentication via SSO
Last updated