AWS IAM Identity Center

Provisioning with AWS IAM Identity Center

This module allows Anjana Data to synchronize users from AWS IAM Identity Center (formerly AWS SSO).

There are two synchronization modes depending on whether application-arn is configured or not:

• Application-filtered mode (with application-arn): Anjana queries the SAML application's assignments via ListApplicationAssignments and resolves only the assigned users and groups. Recommended when only a subset of the organization should have access.

• Full Identity Store mode (without application-arn): Anjana calls ListUsers directly on the Identity Store and synchronizes all users in the directory.

Part 1: Configuration in AWS (IAM User)

To securely access the AWS API, we will create a technical user (IAM User) with restricted read permissions.

Step 1: Create IAM User

1. Go to the IAM (Identity and Access Management) console, not Identity Center.

2. Go to Users > Create user.

3. Assign a name (e.g. anjana-provisioning-user).

4. Do not check the box for access to the management console (we only need programmatic access).

5. Complete the creation.

6. Once created, go to the Security credentials tab > Access keys > Create access key.

7. Select "Local code" or "Third-party application".

8. Important: Copy and save the Access Key and the Secret Key.

Step 2: Assign Permissions (Policy)

The required permissions vary depending on the mode you are going to use:

Application-filtered mode (with application-arn):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AnjanaProvisioningRead",
            "Effect": "Allow",
            "Action": [
                "sso:ListApplicationAssignments",
                "identitystore:DescribeUser",
                "identitystore:DescribeGroup",
                "identitystore:ListGroupMemberships",
                "identitystore:GetGroupId",
                "identitystore:GetUserId"
            ],
            "Resource": "*"
        }
    ]
}

Full Identity Store mode (without application-arn):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AnjanaProvisioningRead",
            "Effect": "Allow",
            "Action": [
                "identitystore:ListUsers"
            ],
            "Resource": "*"
        }
    ]
}

3. Assign a name to the policy (e.g. AnjanaProvisioningPolicy) and save the changes.

Part 2: Obtaining IDs in IAM Identity Center

We need to locate the Identity Store ID and, if you are going to use filtered mode, also the application's ARN.

1. Go to the IAM Identity Center console.

2. Identity Store ID:

   • In the side menu, go to Settings.

   • Look for the "Identity store" section.

   • Copy the Identity Store ID (e.g. d-9067xxxxxx).

3. Application ARN (only for application-filtered mode):

   • Go to Applications.

   • Select the SAML application you created for Anjana Data.

   • In the details header, copy the application ARN (e.g. arn:aws:sso::123456789012:application/ssoins-xxxx/apl-yyyy).

Part 3: Configuration in application.yml

Application-filtered mode (with application-arn)

Only the users and groups assigned to the specified application are synchronized.

security:
  provisioning:
    providers:
      aws-iam-ic:
        aws-prod:
          region: "eu-west-1"
          access-key: "AKIAXXXXXXXXXXXXXXXX"
          secret-key: "SUPER_SECRET_KEY_XXXXXXXXXXXXXXXX"
          identity-store-id: "d-9067xxxxxx"
          # Application ARN (Part 2)
          application-arn: "arn:aws:sso::123456789012:application/ssoins-xxxx/apl-yyyy"

Full Identity Store mode (without application-arn)

All users in the Identity Store are synchronized.

security:
  provisioning:
    providers:
      aws-iam-ic:
        aws-prod:
          region: "eu-west-1"
          access-key: "AKIAXXXXXXXXXXXXXXXX"
          secret-key: "SUPER_SECRET_KEY_XXXXXXXXXXXXXXXX"
          identity-store-id: "d-9067xxxxxx"
          # application-arn not configured -> synchronization of the entire Identity Store

Property Summary

Custom field mapping (field-mapping)

Anjana includes a default mapping that covers common cases. You can override any field by indicating the provider key from which the value should be read. The keys are listed in priority order: the first non-empty value is used.

Default mapping

Available fields

Configuration example

security:
  provisioning:
    providers:
      aws-iam-ic:
        aws-prod:
          region: "eu-west-1"
          access-key: "..."
          secret-key: "..."
          identity-store-id: "d-9067xxxxxx"
          field-mapping:
            # Use displayName as the name if givenName is empty
            first-name: ["givenName", "displayName"]
            # Read title and, if empty, use userType
            title: ["title", "userType"]