To create a Single Sign-On on AWS follow the steps below:

AZURE

• Open Azure Active Directory: https://aad.portal.azure.com and enter on Enterprise application:

• Click on “New application” search for AWS Single-Account Access and then click on “Create“

• Once it´s done, access the new application

• Click on the left menu, access “Single Sign-on” and select the SSO method to SAML

• As soon SAML is open you will receive a notification “Save single sign-on setting“. Click on Yes.

After the warning of save successfully, refresh the page… It will display the Identifier and Reply URL correctly.

• Scroll down to step 03 and download Federation Metadata XML. We´ll use it on AWS. Don´t forget to double-check the notification email.

• Go back to AAD, and create an assigned security group. Assign the users to it and take note of the name of the group because we´ll use it with SSO on AWS.

AWS

• It´s time to setup the AWS. Open the AWS console with your ROOT ACCOUNT https://aws.amazon.com/
• Once you are in, search for IAM

• On left panel, open Identity providers

• Select on provider type select SAML,
• Give a name for your Provider – in my case, I called AzureAD
• From the Metadata document, choose the XML that you download from Azure
• and then click on Add Provider

• Access again the provider. Now we´ll add the IAM role to it.

• Click on Assign role

• Create a new role  – > NEXT

• Select SAM 2.0 Federation
• SAML Provider -> select the name of the Provider – in my case AzureAD
• Check “Allow programmatic and AWS Management Console Access“

• On the next page search for the permission that you want to assign to users when they log in. I used the system administrator here.

• At review page, write the role name
• Role name: THE-NAME-OF-GROUP-ON-AZURE-AD
  • REMEMBER: If you don´t do it this way it won’t going to work…

• Now we need to create a new Policy.
• Select Policies from left menu
• and click on Create Policy:

• Change the view to JSON and paste the data below:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
            "iam:ListRoles"
            ],
            "Resource": "*"
        }
    ]
}

• Policy Name: AzureAD_SSOUserRole_Policy

• Now we need to create a user with API access.
• On left menu click on Users and ADD USERS

• User name: AzureADRoleManager

• Permission options: Attach policies directly
• Select the policy that we created before: AzureAD_SSO_user_role_Policy

• Click on next to review and create.
• Access the new user again

• Go to Security Credentials  and click on Create Access Key

• Select the use case Other

• Click on Create Access Key

• At the next screen, take note of the Access Key and Secret Access Key. We´ll use it back on Azure AD.

AZURE

• Back to Azure -> Access the Enterprise Application and open the app AWS Single-Account Access

• Go to Provisioning -> Get- started

• Change the Provisioning Mode: Automatic
• Admin Credentials:
  • clientsecret: AWS-ACCESS-KEY
  • Secret Token: AWS-SECRET-ACCESS-KEY
    • Both you get from user that you create on AWS
  • Click on Test Connection -> Save

• Go out from the Provisioning screen and access again – It´s necessary just to refresh the page.
• Now click on Edit Provisioning

• Turn on Provision Status

• At last, Go to Users and Groups from the enterprise application and add who is going to have access.
  • If you don´t have Azure AD Premium you cannot add a GROUP here.
  • The users must be members of the security group even if it is added manually at Users and Groups from the enterprise application.
  • The security group must be direct members

• You must wait the provision time of synchronization (could take up to 40min)
• To test, access the: https://myapplications.microsoft.com/ end click on AWS icon