Security business menu
Security business
HOME
To be elected
cause
Service
Handling Manufacturer
Examples/reports/
Blog/Glossary
Seminar/
video on demand
Event/Seminar
video on demand

I tried managing everything from SSO to authorization with Okta using Okta-AWS integration!

Introduction

According to Okta's annual research report, Businesses at Work 2023, the most popular combination among Okta customers adopting multicloud is Amazon Web Services (AWS) and Google Cloud Platform (GCP). It is mentioned.
Additionally, according to the same report, among the apps used via Okta in 2022, AWS is also the second most used app after Microsoft 365.
Reference source: https://www.okta.com/jp/press-room/press-releases/okta-businesses-at-work2023/

This time, we linked AWS and Okta and verified SSO, ID management, and even AWS account authority management. If you are currently using AWS, we hope that you will find this helpful as a reference when considering implementing IDaaS.

Okta-AWS integration overview

What is AWS IAM Identity Center?

AWS offers a variety of services, but this time we linked AWS IAM Identity Center and Okta.
AWS IAM Identity Center is a service that manages sign-in security for AWS workforce users, allowing you to centrally manage all AWS accounts and applications. (https://aws.amazon.com/jp/iam/identity-center/)
Simply put, it is a service that allows you to manage which resources can be used by which users on AWS.
Therefore, by linking Okta and AWS IAM Identity Center, you can manage access to resources in your AWS account with Okta.

In Okta, when linking provisioning with AWS IAM Identity Center, privileges can be granted/revoked as shown in the diagram below.

*Granting/revoking privileges during provisioning is effective for some SaaS. For other SaaS, if the corresponding API is available, you can use Okta Workflows to manage licenses and permissions in the same way.

What is AWS IAM Identity Center?

Okta-AWS IAM Identity Center SSO integration

Okta provides a SaaS integration template called OIN, so specify and configure OIN for AWS IAM Identity Center integration.

1. Select the AWS IAM Identity Center template on the Okta management screen

Click View SAML setup instructions in the AWS IAM Identity Center app created on Okta and proceed with the settings according to the instructions.

2. Click View IdP metadata to display the metadata required for SAML linkage, so save it as a file.
3. Set the information required for SSO integration in AWS IAM Identity Center
  • AWS IAM Identity Center Settings > Identity Source tab, click "Change Identity Source"
  • Select “Identity Center Directory” > “External Identity Provider” as the identity source
  • After uploading the metadata file saved in step 2 using the external IdP settings, paste the ACS URL and Issuer URL into the Okta app settings.

*When actually performing SSO, you will be redirected to Okta by accessing the "AWS access portal sign-in URL" displayed in step 3.

4. Finally, click "Change identity source" in AWS IAM Identity Center to complete the SSO integration setup.

Okta-AWS IAM Identity Center provisioning integration

Okta provides a SaaS integration template called OIN, so specify and configure OIN for AWS IAM Identity Center integration.

1. Select the AWS IAM Identity Center template on the Okta management screen

Click View SAML setup instructions in the AWS IAM Identity Center app created on Okta and proceed with the settings according to the instructions.

2. Click View IdP metadata to display the metadata required for SAML linkage, so save it as a file.
3. Set the information required for SSO integration in AWS IAM Identity Center
  • AWS IAM Identity Center Settings > Identity Source tab, click "Change Identity Source"
  • Select “Identity Center Directory” > “External Identity Provider” as the identity source
  • After uploading the metadata file saved in step 2 using the external IdP settings, paste the ACS URL and Issuer URL into the Okta app settings.

*When actually performing SSO, you will be redirected to Okta by accessing the "AWS access portal sign-in URL" displayed in step 3.

4. Finally, click "Change identity source" in AWS IAM Identity Center to complete the SSO integration setup.

User group synchronization and authorization

1. Enable “Automatic Provisioning” in AWS IAM Identity Center
2. Paste "SCIM endpoint" and "access token" of AWS IAM Identity Center into "Base URL" and "API Token" of Okta provisioning settings to enable API integration.
3. Enable the required features in Okta provisioning settings

The provisioning linkage is now complete.

User group synchronization and authorization

This time, we created a permission set in advance on the AWS IAM Identity Center side. By assigning this permission set to users performing SSO to AWS, the range of privileges available on AWS is specified. Here we have created the following permission set:

  • SystemAdministrator: Specify "SystemAdministrator" from the predefined permission set
  • ViewOnlyAccess: Specify "ViewOnlyAccess" from the predefined permission set

Additionally, on the Okta side, we created groups for each user to whom we would like to grant the above permission set.

1. Create group for AWS IAM Identity Center synchronization

In this user/group synchronization, the groups are divided as follows.

  • AWS_orgTest1_SystemAdmin
    SystemAdministrator user group push group
  • AWS_orgTest1_SystemAdmin_Assign
    Group for user synchronization for SystemAdministrator users
  • AWS_orgTest1_ViewOnlyAccess
    ViewOnlyAccess user's group push group
  • AWS_orgTest1_ViewOnlyAccess_Assign
    Group for user synchronization for ViewOnlyAccess users

*Group push is a function that pushes groups and memberships from Okta to partner applications. You can link existing groups between Okta and the application, or create groups on the Okta side as new groups on the application side.

2. Add groups ① and ③ on the Push Groups tab of the AWS IAM Identity Center app settings on Okta, and create the group from Okta → AWS.
3. Assign the permission set (SystemAdministrator, ViewOnlyAccess) to the group created in 2.
4. Assign groups (②, ④) for provisioning users to Okta → AWS IAM Identity Center to the AWS IAM Identity Center app on Okta
5. Create group rules to be automatically assigned to each group based on attribute values.

First, create "AWS_Group" as a custom attribute for the user, and specify the permission set (e.g. SystemAdministrator) that you want to assign in AWS IAM Identity Center as the attribute value. Then, create a group rule such as ``Assign users whose AWS_Group attribute value is "SystemAdministrator" to the AWS_SystemAdmin group.''

6. Triggered by assignment to a group, provisioning from Okta to AWS IAM Identity Center operates as shown below.
  • Okta→Create user to AWS IAM Identity Center
  • Assign users to groups created in Okta→AWS IAM Identity Center

In the above flow, the user is assigned to the group to which the permission set was previously assigned on the AWS IAM Identity Center side, and the permission set is automatically assigned to the user. Therefore, it is possible to manage AWS user privileges by setting groups on the Okta side.

SSO to AWS

Actual SSO to AWS works as follows, allowing login with the assigned permission set.

Summary

In this blog, we introduced SSO and provisioning collaboration with AWS IAM Identity Center using OIN (Okta Integration Network). What did you think?
Okta provides OIN that allows you to not only create/update/disable users, but also manage permissions depending on the SaaS, so you can greatly automate access management to SaaS.

If you are interested in integrating with AWS IAM Identity Center or other SaaS, or have any inquiries regarding Okta, please contact us.

Inquiry/Document request

In charge of Macnica Okta Co., Ltd.

inquiry Document request

Mon-Fri 8:45-17:30