Integrating AWS IAM Identity Center with Okta
In this comprehensive guide, we walk you through the process of integrating AWS IAM Identity Center with Okta to streamline and secure identity management within your organization. With detailed steps and illustrative screenshots, you'll learn how to configure Okta for seamless integration with AWS IAM Identity Center, manage users and groups in Okta, define and apply permission sets in AWS IAM Identity Center
Published Aug 5, 2024
Last Modified Aug 9, 2024
AWS IAM Identity Center is the recommended AWS service for managing human user access to AWS resources. It is a single place where you can assign your workforce users, also known as workforce identities, consistent access to multiple AWS accounts and applications. IAM Identity Center is offered at no additional charge.
With IAM Identity Center, you can create or connect workforce users and centrally manage their access across all their AWS accounts and applications. You can use multi-account permissions to assign your workforce users access to AWS accounts. You can use application assignments to assign your users access to AWS managed and customer managed applications.
Your identity source in IAM Identity Center defines where your users and groups are managed. After you configure your identity source, you can look up users or groups to grant them single sign-on access to AWS accounts applications, or both.
You can have only one identity source per organization in AWS Organizations. You can choose one of the following as your identity source:
- Identity Center directory – When you enable IAM Identity Center for the first time, it is automatically configured with an Identity Center directory as your default identity source. This is where you create your users and groups, and assign their level of access to your AWS accounts and applications.
- Active Directory – Choose this option if you want to continue managing users in either your AWS Managed Microsoft AD directory using AWS Directory Service or your self-managed directory in Active Directory (AD).
- External identity provider – Choose this option if you want to manage users in an external identity provider (IdP) such as Okta or Microsoft Entra ID.
- Sign Up for an Okta Developer Account
- Visit the Okta Developer Signup page
- Select "Access the Okta Developer Edition Service"
- Download the Okta Verify App
- Sign up using your Google Account, GitHub, or by entering your personal details
- Install the Okta Verify App on your mobile device.
- Scan the QR Code
- Open the Okta Verify App and scan the QR code displayed on your screen.
- Access the Okta Dashboard
- After successfully logging in, you will be directed to the Okta landing page.
- Navigate to the Applications Section
- In the Okta admin dashboard, look at the left-hand menu pane.
- Find and expand the
Applications
section by clicking on it.
- Access the Applications Page
- After expanding
Applications
, click onApplications
in the dropdown menu. This will take you to the Applications page.
- Browse the App Catalog
- On the Applications page, locate and click the
Browse App Catalog
button. This will open the app catalog where you can search for applications.
- Search for AWS IAM Identity Center
- In the search box that appears, type
AWS IAM Identity Center
. - Click on the app that matches
AWS IAM Identity Center
to select it.
- Add the Integration
- After selecting the AWS IAM Identity Center app, click the
Add Integration
button. This will initiate the process to add the integration. - Provide an Application Label in Add AWS IAM Identity Center and click
Done
button.
- Open the Sign On Tab
- Once you have selected the AWS IAM Identity Center app, you will be directed to the app’s settings page.
- Click on the
Sign On
tab to view SAML settings.
- View the SAML Metadata
- Copy the SAML Metadata
- In the new browser tab displaying the XML file, find and select all content between
<md:EntityDescriptor>
and</md:EntityDescriptor>
. - Right-click and choose
Copy
to copy the selected XML content.
- Save the Metadata to a File
- Open a text editor (such as Notepad on Windows or TextEdit on macOS).
- Paste the copied XML content into the text editor.
- Save the file with the name
metadata.xml
to a convenient location on your computer.
- Keep the Okta Admin Dashboard Open
- Do not close the Okta admin dashboard as you will need it for additional configuration steps later.
- Open the IAM Identity Center console dashboard
- Go to the IAM Identity Center console.
- Enable IAM Identity Center
- If this is your first time accessing IAM Identity Center, you'll be prompted to enable it. Click
Enable
button
- Enable with AWS Organizations
- You'll have two options: Enable with AWS Organizations or Enable in only this AWS account.
- For this workshop choose Enable with AWS Organizations and click
Continue
button This will allow you to manage access across your entire organization. - The other option,
Enable in only this AWS account
doesn't support granting users and groups access to AWS accounts in an AWS organization
- Confirm Identity Source:
- In the IAM Identity Center setup section, choose the Confirm identity source button.
- Location: The setup section is on the IAM Identity Center console homepage under Settings.
- Alternatively, navigate to Settings and then choose the Identity source tab.
- Change Identity Source:
- By default, the Identity Center directory will be the identity source.
- To change this, choose the Change identity source option from the Actions dropdown menu.
- Select External Identity Provider (Okta)
- Select External identity provider and click Next.
- Upload the Metadata File:
- Upload the SAML metadata file (metadata.xml) downloaded from Okta (Step 15)
- Click Next
- Review and confirm
- Type ACCEPT in the confirmation text box
- Click Change identity source button
- Enable Automatic Provisioning in IAM Identity Center
- In the IAM Identity Center console on the Settings page, locate the Automatic provisioning information box, and then choose Enable.
- This enables automatic provisioning in IAM Identity Center and displays the necessary SCIM endpoint and access token information.
- Copy SCIM Endpoint and Access Token
- In the Inbound automatic provisioning dialog box, copy each of the values for the following options:
- SCIM endpoint
- Access token
- Later in this workshop, you will enter these values to configure provisioning in Okta.
- Choose Close.
- Navigate to IAM Identity Center Application in Okta
- Return to the Okta admin dashboard
- Navigate to the IAM Identity Center application created before.
- Open the Provisioning Tab
- On the IAM Identity Center app page, choose the Provisioning tab.
- In the left navigation under Settings, choose Integration.
- Enable API Integration
- Choose Edit, and then select the checkbox next to Enable API integration to enable provisioning.
- Configure Okta with the SCIM provisioning values from IAM Identity Center that you copied earlier
- In the Base URL field, enter the SCIM endpoint value. Make sure that you remove the trailing forward slash at the end of the URL.
- In the API Token field, enter the Access token value.
- Choose Test API Credentials to verify the credentials entered are valid. The message AWS IAM Identity Center was verified successfully! displays.
- Choose Save. You are navigated to the Settings area, with Integration selected.
- Enable Provisioning to App
- Under Settings, choose To App, and then select the Enable checkbox for each of the Provisioning to App features you want to enable. For this workshop, select all the options.
- Choose Save.
- Verify the connection
- Verify the connection by clicking the
Test API Credentials
button. - Choose Save.
- Select checkbox for Create Users, Update User Attributes, Deactivate Users to manage users from OKTA
- Navigate to IAM Identity Center App in Okta
- Return to the Okta admin dashboard
- Navigate to Groups Section
- Open Directory
- In the left-hand menu pane, click on Directory.
- Access Groups
- Choose Groups from the dropdown menu. This will take you to the list of existing groups.
- Add New Group
- Click on the Add Group button to create a new group.
- Enter Group Details:
- Fill in the required details for the new group, including:
- Group Name: Enter a descriptive name for the group.
- Group Description (optional): Provide a description for the group’s purpose.
- Save the New Group
- After entering the details, click Save to create the group.
- Check Group List to Verify User Created:
- Ensure that the newly created group appears in the Groups section.
- Reload the page to see the newly created group
- Open Okta Dashboard
- Return to the Okta admin dashboard
- Navigate to People Section in Directory
- In the left-hand menu pane, click on Directory.
- Choose People from the dropdown menu. This will take you to the list of existing users.
- Click on the Add Person button to create a new user.
- Enter User Details
- Fill in the required details for the new user, including:
- First Name
- Last Name
- Username
- Email
- Password
- Select the group created in the previous stage.
- Save the New User
- After entering the details, click Save to create the user.
- Check User List to Verify User Created:
- Ensure that the newly created user appears in the People section.
- Reload the page to see the newly created user
- Assign People
- In the Okta IAM Identity Center app page, choose the Assignments tab.
- In the Assignments page, choose Assign, and then choose Assign to people.
- Choose the Okta users that you want to have access to the IAM Identity Center app. Choose Assign, choose Save and Go Back, and then choose Done.
- This starts the process of provisioning the users into IAM Identity Center.
- Assign Groups:
- In the Assignments page, choose Assign, and then choose Assign to groups.
- Choose the Okta groups that you want to have access to the IAM Identity Center app. Choose Assign, choose Save and Go Back, and then choose Done.
- This starts the process of provisioning the users in the group into IAM Identity Center.
- Push Groups
- Choose the Push Groups tab.
- Choose the Okta group that contains all the groups that you assigned to the IAM Identity Center app.
- If the group that created in the previous step not found in the list, choose
Find groups by name
option by clicking (+)Push Groups Menu Button. - Enter the group name that we created in the previous step.
developer-group-from-okta
- Click Save Button.
- The group status changes to Active after the group and its members have been pushed to IAM Identity Center.
- Synchronize Individual Users:
- If you have users that aren't members of the groups that you pushed to IAM Identity Center, add them individually:
- In the Assignments page, choose Assign, and then choose Assign to People.
- Choose the Okta users that you want to have access to the IAM Identity Center app. Choose Assign, choose Save and Go Back, and then choose Done.
- This starts the process of provisioning the individual users into IAM Identity Center.
- Verify Synchronization
- Return to the IAM Identity Center console. In the left navigation, select Users; you should see the user list populated by your Okta users.
For an example, we will be providing AmazonS3FullAccess permission to the `developer-from-okta` group members that we created from okta.
- Access AWS IAM Identity Center
- Open your AWS Management Console and navigate to AWS IAM Identity Center.
- In the IAM Identity Center navigation pane, under Multi-account permissions, choose AWS accounts.
- Select Management Account
- On the AWS accounts page, the Organizational structure displays your organizational root with your accounts underneath it in the hierarchy. Select the checkbox for your management account, then select Assign users or groups.
- Open Assign Users and Groups Workflow
- The Assign users and groups workflow displays. It consists of three steps.
- Select User
- Choose the group that needed the S3 bucket Full Permission. Then choose Next.
- Create Permission Set
- Choose Create permission set to open a new tab that steps you through the three sub-steps involved in creating a permission set.
- Permission Set Type
- In Permission set type, choose Custom permission set.
- Specify Policies
- In Specify policies and permissions boundary, select AmazonS3FullAccess
- Choose Next.
- Specify Permission Set Details
- Provide a valid name for the permission-set
- Keep the other values as default and choose Next.
- Review and Create
- Verify that the Permission set type uses the AWS managed policy AmazonS3FullAccess. Choose Create.
- A notification appears informing you that the permission set was created. You can close this tab in your web browser now.
- Select Created Permission Set
- In the Permissions sets area, choose the Refresh button.
- The AdministratorAccess permission set you created appears in the list. Select the checkbox for that permission set and then choose Next.
- Review and Submit
- Review the selected user and permission set, then choose Submit. The page updates with a message that your AWS account is being configured. Wait until the process completes.
- Copy AWS access portal URL
- Open your AWS Management Console and navigate to AWS IAM Identity Center.
- Copy AWS access portal URL under Settings Summary
- [Optional] Optionally you can edit the AWS access portal URL to a friendly name
- Open the URL
- This will open the okta login page
- Login with the password you have provided while creating the user
- You will see the permission set that created. Click on that to open the AWS console.
- Congrats, you have now full access in S3.
You have successfully configured okta and integrated with AWS IAM Identity Center.