SSO

Introduction

• Centrally manage Single Sign-On to access multiple accounts and 3rd party business applications.

• Integrated wth AWS Organizations, on-premise AD

• Supports SAML 2.0

• Centralized auditing with CloudTrail

Feature

• Options for Setting up with AD

  • Standalone AWS Managed Microsoft AD

  • AD Connector to on-premise AD

  • AWS Managed Microsoft AD with 2-way forest trust with on-premise AD

• Regular AssumeRoleWithSAML vs SSO

  • AssumeRoleWithSAML Steps:

    • Client talks to 3rd party IdP login portal to get SAML response

    • send SAML to STS to get credentials.

  • AWS SSO Steps:

    • Client talks to AWS SSO login portal which directly talks to identity store that is compatible with SAML 2.0 then returns the credential to client.

  • Advantages to use AWS SSO:

    • Doesn't need the 3rd party login portal.

    • Simplifying 2 steps into 1.