Skip to main content
Latest Documentation
This is the latest documentation for the Cloud Posse Reference Architecture. To determine which version you're currently using, please see Version Identification.
Sponsor @cloudposse
Version: Latest

AWS Identity Center (SSO) ClickOps

This guide provides an overview of setting up AWS Identity Center (SSO) with ClickOps, detailing prerequisites and supported external identity providers. It explains how to integrate AWS SSO with providers like Azure AD, JumpCloud, Okta, and Google Workspace, including specific steps for configuring each.

How it Works​

AWS Single Sign-On (AWS SSO) is a service that simplifies access management for AWS accounts and applications. It enables users to sign in to AWS once and access multiple AWS accounts and applications without the need to re-enter credentials. To use it with an identity provider (IdP) for AWS SSO, administrators typically need to configure the integration within the AWS Management Console. This involves setting up a new AWS SSO instance, connecting it to the IdP, and specifying the users or groups that should have access to AWS resources. AWS SSO provides logging and auditing capabilities, allowing organizations to track user access to AWS resources and monitor security-related events.

1 SAML-Based Authentication​

The integration between the IdP and AWS SSO relies on the Security Assertion Markup Language (SAML) for authentication and authorization. SAML enables the exchange of authentication and authorization data between your IdP and AWS, allowing users to log in once to their IdP and gain access to AWS resources without additional logins.

2 User Provisioning​

AWS SSO can be configured to automatically provision and de-provision user accounts based on changes in the IdP directory. This helps keep user access in sync with changes made in your IdP.

3 AWS SSO Permission Sets​

AWS SSO allows administrators to define fine-grained access policies, specifying which AWS accounts and services users from the IdP can access.

4 Multi-Factor Authentication (MFA)​

Organizations using an IdP for authentication with AWS SSO can enhance security by enforcing multi-factor authentication (MFA) for added identity verification.

Once configured, users can experience single sign-on when accessing AWS resources. They log in to their IdP account and seamlessly gain access to AWS without needing to provide credentials again.

It's important to note that the specifics of the integration process may be subject to updates or changes, so it's recommended to refer to the official AWS documentation and your IdP's documentation for the most accurate and up-to-date information.

Prerequisites​

First, enable the AWS IAM Identity Center (successor to AWS Single Sign-On) service in the core-root account. This is the account where the aws-sso component will be deployed.

  1. Navigate to the core-root account in the AWS Web Console
  2. Select your primary region
  3. Go to AWS IAM Identity Center (successor to AWS Single Sign-On)
  4. Enable the service

Configure your Identity Provider​

These are the instructions for the most common Identity Providers. Alternatives are available, but the steps may vary depending on the provider.

It's important to note that the specifics of the integration process may be subject to updates or changes, so it's recommended to refer to the official AWS documentation and respective IdP documentation for the most accurate and up-to-date information based on your current date.

For providers not included in the following section, please follow the AWS documentation for setting up an IdP integration with AWS. This list includes Azure AD, CyberArk, OneLogin, and Ping Identity.

Okta is a common business suite that has an active director to manage users and permissions. We can utilize this to login to AWS by leveraging Applications that are used to sign in to things from your Okta Account.

Setup Okta​

  1. Under the Admin Panel go to Applications
  2. Click Browse App Catalog
  3. Search for AWS IAM Identity Center and click Add Integration
  4. Keep the default settings of App Label ("AWS IAM Identity Center") and Application Visibility
  5. Go to Sign On and Copy information from the SAML Metadata section, this will be used in AWS SSO.
  6. Then go to Provisioning and click Configure API Integration

Setup AWS SSO​

  1. Sign into AWS SSO under your management account (core-root)
  2. Go to the AWS IAM Identity Center (successor to AWS Single Sign-On) application
  3. Enable IAM Identity Center
  4. On the left panel click Settings
  5. Under Identity Source click edit and add an External identity provider
  6. Copy the information from Okta into the fields
  7. The Okta App will need to be updated with the Service provider metadata

Required Groups​

Before deploying the aws-sso component, you must create the following groups in your Identity Provider. These names are case-sensitive and must match exactly:

  1. Managers — Full access to all accounts
  2. DevOps — Full access to most accounts (except root)
  3. Developers — Limited access for development work
  4. BillingAdmin — Access to billing and cost management

Once these groups are provisioned and synced to AWS Identity Center, you can deploy the aws-sso component.

Deploy Permission Sets​

The aws-sso component deploys all Permission Sets and assigns them to the appropriate groups. This includes:

  1. TerraformApplyAccess — Write access for Terraform operations
  2. TerraformPlanAccess — Read-only access for Terraform plan operations
  3. TerraformStateAccess — Access to Terraform state only
  4. AdministratorAccess — Full AWS administrator access
  5. PowerUserAccess — Power user access without IAM management
  6. ReadOnlyAccess — Read-only access to AWS resources
  7. RootAccess — Organizational root access for privileged operations (see Centralized Root Access)

The aws-sso component is responsible for deploying all Permission Sets and mapping them to the appropriate groups per account. This mapping is configured in stacks/catalog/aws-sso.yaml, where you define which groups receive which Permission Sets for each account type. This is how you assign permissions to users — by adding them to the appropriate IdP group, they automatically receive the corresponding Permission Sets when they access AWS.

Deploy the component using the identity workflow:

Loading workflow...
Groups Must Exist First

The aws-sso component will fail if the required groups (Managers, DevOps, Developers, BillingAdmin) do not exist in AWS Identity Center. Ensure your IdP is configured and groups are synced before deploying.

Next Steps​

Centralize root access

Now that Identity Center and Permission Sets are provisioned, configure centralized root access management. This allows secure, auditable root operations on member accounts without maintaining root credentials. Centralize Root Access