Description

Ensure that at least one SAML 2.0 identity provider is configured in IAM, so that users can sign in through the organization's identity provider (IdP) and obtain temporary AWS credentials with the AWS STS AssumeRoleWithSAML operation, instead of using long-lived IAM user credentials.

Rationale

Without SAML federation, people usually access AWS with IAM users and long-lived access keys. Leaked or stolen keys give persistent API access that can be used to exfiltrate data or change resources and policies, and they are hard to track and revoke. SAML federation issues short-lived credentials, centralizes user management, MFA and session limits in the corporate identity provider, and improves accountability. Federated users should be mapped to roles with least privilege, and IAM user access keys should be retired for interactive use.

Impact

  • Users sign in with their corporate identity and receive short-lived credentials

  • Access is managed and revoked centrally in the identity provider

  • Requires setting up the identity provider and IAM roles that federated users can assume

  • Creating the provider alone does not change existing access; IAM users keep working until they are retired

Default Value

No SAML identity providers are configured in a new AWS account.

Pre-Requisites

  • IAM permissions: iam:ListSAMLProviders, iam:CreateSAMLProvider, iam:CreateRole and iam:DeleteSAMLProvider

  • The SAML metadata XML document exported from the organization's identity provider

  • A design of the IAM roles and permissions that federated users will receive

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Identity providers in the left menu.

  3. Check whether at least one provider of type SAML is listed. Accounts that receive access through AWS IAM Identity Center include a SAML provider created by IAM Identity Center.

  4. If no SAML provider exists, follow the implementation steps.

CLI:

List the SAML providers in the account:

aws iam list-saml-providers --query "SAMLProviderList[].[Arn,CreateDate]" --output table

The account fails if no SAML provider is returned.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Identity providers in the left menu.

  3. Choose Add provider.

  4. Select SAML as the provider type.

  5. Enter a Provider name and upload the metadata document from your identity provider.

  6. Choose Add provider.

  7. Create IAM roles for SAML 2.0 federation that trust this provider, attach least-privilege permissions, and map them to users or groups in your identity provider.

CLI:

Create the SAML provider from the identity provider's metadata file:

aws iam create-saml-provider --name <SAML_PROVIDER_NAME> --saml-metadata-document file://metadata.xml

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Identity providers in the left menu.

  3. Select the SAML provider and choose Delete.

  4. Delete any IAM roles that were created only for this provider.

CLI:

aws iam delete-saml-provider --saml-provider-arn arn:aws:iam::<ACCOUNT_ID>:saml-provider/<SAML_PROVIDER_NAME>

Note: deleting the provider stops all federated sign-ins through it, so users who depend on it lose access to the account.

Reference