Identities and Federation Flashcards
What critera exists (5 things) to point you to use SAML 2.0 Federation?
You have an enterprise identity provider
That provider is SAML 2.0 compatible
You have an enterprise IAM team
You want a single source of truth
You have 5000 or more identities
What AWS security constructs does SAML use?
IAM roles
Temporary Credentials (STS), usually 12 hour validity
What two types of use cases uses SAML assertion?
in house developed app access AWS resources
Console access
What is the key API call used in conjunction with SAML 2.0 assertion?
STS:AssumeRoleWithSAML
What must be done before an in house developed application can use SAML Identity federation?
A two way trust must be establisd between the IDP and AWS IAM:
- The internal IDP must trust AWS IAM
- you must confgiure/register the SAML IDP in IAM
SAML IN house app Diagram
What must be configured before you can use SAML to grant access to the console?
Trust established between IDP and AWS using SAML/SSO Endpoint
What is the main difference between the SAML process for an in house developed app and console access?
For console acces, the AWS SAML/SSO endpoint is generating a console URL in addition to the STS creds for the user to use to access AWS
SAML Console Diagram
Does AWS prefer AWS SSO or the traditional SAML based federation for workloads going forward?
AWS SSO
Name the four options for identity stores in AWS SSO
Built In
AWS Managed Microsoft AD
On premsis AD (two trust or AD connector)
External Idendity Provider (SAML 2.0)
Three main benefits of AWS SSO
Single sign on to all accounts in an organization
Centralized permissions config and management across AWS accounts in an org
SSO to busines apps (o365, slack, salesforce) and custom SAML apps
