> For the complete documentation index, see [llms.txt](https://awsinpractice.itassist.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://awsinpractice.itassist.com/study-group/aws-certified-solutions-architect-associate/domain-1-design-secure-architectures/copy-of-task-statement-1.1-design-secure-access-to-aws-resources/federated-access-with-okta.md).

# Federated Access With Okta

**Objective:** Configure **AWS IAM Identity Center (AWS SSO) with Okta** to enable **federated login to AWS using Okta as the Identity Provider (IdP).**\
🔹 **Outcome:** Users will **log in to AWS using Okta credentials** instead of IAM Users, and **IAM Identity Center will dynamically assign IAM Roles**.

***

## **📌 Prerequisites**

✅ **AWS IAM Identity Center (AWS SSO) is enabled** in your AWS account.\
✅ **Okta Admin access** (to configure the enterprise app).\
✅ **AWS Organizations is set up** (for multi-account management).

***

## **🛠️ Step 1: Enable IAM Identity Center in AWS**

📌 **Go to IAM Identity Center Console**\
1️⃣ Navigate to **AWS Console → IAM Identity Center**.\
2️⃣ Click **Enable IAM Identity Center** (if not already enabled).\
3️⃣ Select **"Use an external identity provider (IdP)"**.\
4️⃣ Copy the **IAM Identity Center SAML Metadata URL** – needed for Okta configuration.

✅ **IAM Identity Center is now ready for federation with Okta.**

***

## **🛠️ Step 2: Configure Okta as the Identity Provider for AWS**

📌 **Set Up AWS IAM Identity Center in Okta**\
1️⃣ Log in to the **Okta Admin Console** (`https://admin.okta.com`).\
2️⃣ Navigate to **Applications** → Click **Create App Integration**.\
3️⃣ Select **SAML 2.0** as the Sign-on method.\
4️⃣ Enter **"AWS IAM Identity Center"** as the app name.\
5️⃣ Click **Next**.

📌 **Configure SAML Settings in Okta**\
6️⃣ **Single sign-on URL:** Paste the **IAM Identity Center SAML Metadata URL** copied from AWS.\
7️⃣ **Audience URI (SP Entity ID):** Enter `urn:amazon:webservices`.\
8️⃣ **Name ID format:** `EmailAddress`.\
9️⃣ Click **Next** → **Save Configuration**.\
🔟 Download the **Okta Metadata XML File**.

✅ **Okta is now configured to authenticate AWS users.**

***

## **🛠️ Step 3: Configure IAM Identity Center to Use Okta**

📌 **Import Okta Metadata into AWS**\
1️⃣ Navigate back to **AWS IAM Identity Center → Settings → Identity Source**.\
2️⃣ Click **Change Identity Source**.\
3️⃣ Select **SAML 2.0-based authentication**.\
4️⃣ Upload the **Okta Metadata XML** file downloaded earlier.\
5️⃣ Click **Next**, review the settings, and **Accept Change**.

✅ **IAM Identity Center is now linked to Okta!**

***

## **🛠️ Step 4: Sync Okta Groups with AWS IAM Identity Center**

📌 **Create Groups in Okta**\
1️⃣ In Okta, go to **Directory → Groups → Create Group**.\
2️⃣ Create a group **SecureCart-Developers**.\
3️⃣ Add **developers to this group** who need AWS access.

📌 **Assign Groups in AWS IAM Identity Center**\
1️⃣ Go to **AWS Console → IAM Identity Center → AWS Accounts**.\
2️⃣ Select the **AWS Account** you want to grant access to.\
3️⃣ Click **Assign Users & Groups**.\
4️⃣ Choose **Okta Groups** (e.g., `SecureCart-Developers`).\
5️⃣ Select a **Permission Set** (e.g., **AdministratorAccess, ReadOnlyAccess**).\
6️⃣ Click **Save**.

✅ **Users in the Okta group can now assume IAM Roles dynamically.**

***

## **🛠️ Step 5: Test AWS Login Using Okta Credentials**

📌 **Test User Login** 1️⃣ Open the **IAM Identity Center User Portal URL** (`https://securecart.awsapps.com/start`).\
2️⃣ Click **Sign in with Okta**.\
3️⃣ Enter **Okta username & password**.\
4️⃣ After authentication, users can see **assigned AWS accounts**.\
5️⃣ Click an account → Assume the **assigned IAM Role**.

✅ **Users now authenticate using Okta and access AWS resources securely!**

***

## **📌 🎯 Bonus: AWS CLI Authentication with Okta & SSO**

✅ **Developers can authenticate to AWS CLI using Okta credentials.**

```sh
shCopyEditaws configure sso
aws sso login --profile SecureCart-Dev
aws sts get-caller-identity
```

📌 **Result:** Users authenticate via Okta and assume an IAM Role without needing IAM credentials.

***

## **📌 Summary of Setup**

| **Step**   | **Action**                             |
| ---------- | -------------------------------------- |
| **Step 1** | Enable IAM Identity Center in AWS      |
| **Step 2** | Set up AWS IAM Identity Center in Okta |
| **Step 3** | Link IAM Identity Center with Okta     |
| **Step 4** | Map Okta Groups to AWS IAM Roles       |
| **Step 5** | Test AWS Login with Okta Credentials   |
| **Bonus**  | Enable AWS CLI authentication via SSO  |