# Federating AWS Access with Active Directory (AD FS) for Hybrid Cloud Access

SecureCart operates **both on-premises infrastructure and AWS cloud**. Employees, especially **Software Architects**, need to securely access **both environments** using their existing **on-premises Active Directory (AD) credentials** without managing separate AWS IAM users.

✅ **Goals:**\
✔ Provide **seamless authentication** using **Active Directory Federation Services (AD FS)**.\
✔ Allow **temporary access to AWS resources** via **IAM roles** instead of IAM users.\
✔ Enable **secure and scalable hybrid cloud access** for SecureCart employees.

***

### **📌 Solution Architecture**

SecureCart implements **SAML 2.0 Federation with AD FS**, allowing employees to **log in with their existing AD credentials** and assume IAM roles in AWS.

🔹 **Components Involved:**\
✔ **Active Directory (AD)** → Manages SecureCart user identities.\
✔ **Active Directory Federation Services (AD FS)** → Acts as the **identity provider (IdP)**, issuing SAML assertions.\
✔ **AWS IAM Roles** → Define permissions for accessing AWS resources.\
✔ **AWS Security Token Service (STS)** → Issues **temporary credentials** based on SAML authentication.

***

### **📌 Step-by-Step Setup Guide**

#### **1️⃣ Set Up Active Directory Federation Services (AD FS)**

🔹 **SecureCart’s IT team sets up AD FS on-premises** to manage authentication.\
🔹 **AD FS validates users via Active Directory and issues SAML assertions**.

✔ **Action Items:**\
1️⃣ Install and configure **AD FS on a Windows Server**.\
2️⃣ Set up **relying party trust** for AWS in AD FS.\
3️⃣ Configure **SAML claim rules** to send **user attributes** (e.g., username, department, role).

🔹 **Why This Matters?**\
✅ **Employees log in using their corporate credentials**—no separate AWS credentials required.\
✅ **AD FS verifies identity and passes authentication info to AWS via SAML assertion**.

***

#### **2️⃣ Configure AWS as a SAML Service Provider**

🔹 SecureCart **registers AD FS as an Identity Provider (IdP) in AWS IAM**.

✔ **Action Items:**\
1️⃣ In AWS IAM, **create a new identity provider**.\
2️⃣ Upload the **SAML metadata file** from AD FS.\
3️⃣ Configure **IAM roles for federated users** (Software Architects, Developers, etc.).

🔹 **Why This Matters?**\
✅ **Allows AWS to trust authentication requests** from SecureCart’s AD FS.\
✅ **IAM roles map federated user attributes** to specific AWS permissions.

***

#### **3️⃣ Create IAM Roles for SecureCart Employees**

📌 IAM roles define **which AWS resources** employees can access **based on their AD group membership**.

✔ **Action Items:**\
1️⃣ Create an **IAM Role for Software Architects** (`SecureCart-Architects`).\
2️⃣ Define **trust relationships** to allow assumption via SAML federation.\
3️⃣ Attach **permissions** to the role (e.g., access to EC2, RDS, S3, VPC).

🔹 **Example IAM Role Trust Policy**

```json
jsonCopyEdit{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789012:saml-provider/SecureCart-ADFS"
      },
      "Action": "sts:AssumeRoleWithSAML",
      "Condition": {
        "StringEquals": {
          "SAML:aud": "https://signin.aws.amazon.com/saml"
        }
      }
    }
  ]
}
```

🔹 **Why This Matters?**\
✅ **IAM roles dynamically map permissions based on user attributes**.\
✅ **Employees assume roles via STS instead of needing IAM users**.

***

#### **4️⃣ SecureCart Employees Log In & Assume IAM Roles**

📌 After setup, SecureCart employees use their **Active Directory credentials** to access AWS.

✔ **Action Items:**\
1️⃣ Employees log in to the **SecureCart AD FS portal**.\
2️⃣ AD FS **authenticates users** and **redirects them to AWS** via SAML assertion.\
3️⃣ AWS **grants temporary IAM session tokens** based on assigned IAM roles.

🔹 **Why This Matters?**\
✅ **No persistent AWS credentials needed**—all authentication is federated.\
✅ **Users only receive permissions assigned to their role**.

***

### **📌 SecureCart User Experience Flow**

#### **1️⃣ Authentication via SecureCart AD FS**

👤 **User Action**:\
✔ Employee logs into **SecureCart's AD FS portal** with their **Active Directory credentials**.

🔹 **Behind the Scenes:**\
✅ **AD FS authenticates user credentials** against Active Directory.\
✅ **Generates a SAML assertion** with user attributes.

***

#### **2️⃣ Role Assumption in AWS**

👤 **User Action**:\
✔ Employee is **redirected to AWS**, assuming an IAM role.

🔹 **Behind the Scenes:**\
✅ AWS IAM **validates the SAML assertion**.\
✅ IAM **maps the employee to an IAM role** based on their AD group.\
✅ AWS STS **issues temporary credentials** valid for up to 12 hours.

***

#### **3️⃣ SecureCart Employees Access AWS Resources**

👤 **User Action**:\
✔ Employee accesses **AWS Console, EC2, S3, RDS, or VPC resources** as per their IAM role.

🔹 **Behind the Scenes:**\
✅ IAM **restricts access** to only **authorized AWS services**.\
✅ AWS CloudTrail **logs all actions** for compliance tracking.

***

### **📌 SecureCart User Experience Flow Diagram**

```
pgsqlCopyEdit+-----------------------------+
| SecureCart Employee         |
+-----------------------------+
           |
           | (1) Logs in to SecureCart AD FS  
           V
+-----------------------------+
| Active Directory (AD FS)    |
+-----------------------------+
           |
           | (2) AD FS authenticates & issues SAML assertion  
           V
+-----------------------------+
| AWS IAM Role Assumption     |
+-----------------------------+
           |
           | (3) AWS STS issues temporary IAM credentials  
           V
+-----------------------------+
| SecureCart AWS Resources    |
+-----------------------------+
           |
           | (4) Employee accesses AWS services  
           V
+-----------------------------+
| EC2 | RDS | S3 | VPC | etc. |
+-----------------------------+
```

***

### **📌 Summary**

🚀 **SecureCart enables federated access using AD FS and SAML 2.0**, allowing employees to log into AWS with their corporate credentials.\
✅ **IAM roles dynamically grant permissions based on AD groups**.\
✅ **AWS STS ensures temporary credentialing—eliminating the need for IAM users**.\
✅ **SecureCart employees can access AWS resources securely without additional login steps**.