===== AWS Single Sign-On ABAC =====

{{tag>AWS Okta Azure-AD G-Suite SAML}}

==== Prerequisites / Assumptions ====
  * An external IdP (Azure AD, Okta, G-Suite) is already integrated and working with AWS SSO
  * AWS SSO and permission sets are being used to access AWS accounts
  * <TAGNAME> is IdP attribute name (Department)
  * <TAGVALUE> is IdP attribute value (Marketing)

==== IdP =====
  * Map IdP attribute to app (AWS SSO) attribute in the following format
  * <code>https://aws.amazon.com/SAML/Attributes/AccessControl:<TAGNAME></code>

=== IdP with SCIM ===
  * Verify in AWS SSO user list attribute was updated with desired value :-)

=== IdP without SCIM ===
  * Manually update attribute in AWS SSO user list :-(

==== AWS SSO ====
  * Enable ''Settings - Identity Source - Attributes for access control''
  * Create permission set that compares resource tag value to user attribute value with IAM policy condition
  * <code>"Condition": {
    "StringEquals": {
        "ec2:ResourceTag/<TAGNAME>": "${aws:PrincipalTag/<TAGNAME>}"
    }
}</code>
  * For an AWS account apply the new permission set to a user / group

=== AWS SSO Optional ===
If you need a user attribute as a principal tag and can't update the IdP to to pass the attribute as an access control.  You can add the key value mapping to the Attributes for access control.  For this to work the attribute value must be show in the AWS SSO users information.
^Key^Value^
|Username|${path:userName}|
==== Validate ====
  * Use CloudTrail to search for the event name "AssumeRoleWithSAML"
  * For an event, verify the user attribute name and value are passed as a SAML session tag (principalTags)
  * <code>{
    "requestParameters": {
        "principalTags": {
            "<TAGNAME>": "<TAGVALUE>"
        }
    }
}</code>

----

Reference Links
  * https://docs.aws.amazon.com/singlesignon/latest/userguide/okta-idp.html
  * https://docs.aws.amazon.com/singlesignon/latest/userguide/azure-ad-idp.html
  * https://docs.aws.amazon.com/singlesignon/latest/userguide/configure-abac-policies.html
  * https://docs.aws.amazon.com/singlesignon/latest/userguide/attributemappingsconcept.html