# Ensure the providers SAML-Based Federation for API Access to AWS:

- Source: https://support.icompaas.com/support/solutions/articles/62000129496-ensure-the-providers-saml-based-federation-for-api-access-to-aws
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [IAM Policies](https://support.icompaas.com/support/solutions/folders/62000096130)
- Last updated: 2026-06-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description: 

AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources. 

  

Rationale: 

Ensure there are SAML Providers

  

Impact:

When you use an IAM identity provider, you don't have to create custom sign-in code or manage your own user identities. The IdP provides that for you. Your external users sign in through a well-known IdP, such as Login with Amazon, Facebook, or Google. You can give those external identities permissions to use AWS resources in your account. IAM identity providers help keep your AWS account secure because you don't have to distribute or embed long-term security credentials, such as access keys, in your application.

  

Default Value:

You can use a role to configure your SAML 2.0-compliant identity provider (IdP) and AWS to permit your federated users to access the AWS Management Console. The role grants the user permissions to carry out tasks in the console. If you want to give SAML federated users other ways to access AWS

  

Pre-Requisite:

1.  Sign in as an IAM user with administrative permissions.
    
2.  Should have IAM role created which gives permission to SAML provider to access AWS console
    
3.  Should have account in any providers which are SAML-Based federation.
    

  

Remediation:

Test Plan:

1.  Sign in to the AWS Management Console.
    
2.  Navigate to IAM dashboard at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).
    

  

3.  In the left navigation panel, choose Identity providers
    
4.  Check whether any Idp are added
    

5.  If not then follow the implementation steps to add identity provider 
    

  

Using AWS CLI:

1.  This command gives the list of SAML providers you added to your account  
    
    aws iam list-saml-providers
    
      
    

Implementation Steps:

1.  Sign in to the AWS Management Console.
    
2.  Navigate to IAM dashboard at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).
    

  

3.  In the left navigation panel, choose Identity providers
    

  

4.  Click on Add provider
    
5.  Select SAML, Give a provider name
    

6.  Now choose the file in which you saved the Meta data from the SAML-Based federation provider
    

  

7.  And the click on Add provider
    

  

Using AWS CLI:

1.  This command creates a SAML provider, give your meta data file url  
    
    aws iam create-saml-provider --saml-metadata-document file://SAMLMetaData.xml --name MySAMLProvider
    
      
    

Backout Plan:

1.  Go to Identity provider, select the Idp you want to delete 
    
2.  Click on action, choose delete
    

  

Resources:

-   [Enabling SAML 2.0 federated users to access the AWS Management Console - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-saml.html) 
    
-   [Providing access to AWS accounts owned by third parties - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html) 
    
-   [list-saml-providers — AWS CLI 1.22.70 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/iam/list-saml-providers.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.