Skip to main content

Integrate with Amazon Web Services (Classic IAM)

Support level: authentik

What is AWS​

AWS, or Amazon Web Services, is a comprehensive cloud computing platform. It provides a wide array of on-demand IT services like computing power, storage, and databases, allowing businesses to build and run applications, and manage infrastructure through the internet.

-- https://aws.amazon.com/what-is-aws

Preparation​

The following placeholders are used in this guide:

  • authentik.company is the FQDN of the authentik installation.
info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

Configuration methods​

AWS Classic IAM can be integrated with authentik via SAML or OIDC. Below are the steps to configure each method.

SCIM Provisioning Limitation

SCIM Provisioning is only supported in conjunction with IAM Identity Center, not Classic IAM.

authentik configuration​

To support the integration of AWS with authentik via the Classic IAM method, you need to create two property mappings and an application/provider pair in authentik.

Create property mappings​

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Customization > Property Mappings, click Create, select SAML Provider Property Mappings, and click Next.

  3. Configure the first mapping for the user's role assignment:

    • Name: provide a descriptive name

    • SAML Attribute Name: https://aws.amazon.com/SAML/Attributes/Role

    • Friendly Name: Leave blank

    • Expression: Choose one of these options:

      For a static role:

      return "arn:aws:iam::<aws_account_ID>:role/saml_role,arn:aws:iam::<aws_account_ID>:saml-provider/authentik"

      For role assignment based on group membership:

      role_name = user.group_attributes().get("aws_role", "")
      return f"arn:aws:iam::<aws_account_ID>:role/{role_name},arn:aws:iam::<aws_account_ID>:saml-provider/authentik"

      For multiple roles:

      return [
          "arn:aws:iam::<aws_account_ID>:role/role_a,arn:aws:iam::<aws_account_ID>:saml-provider/authentik",
          "arn:aws:iam::<aws_account_ID>:role/role_b,arn:aws:iam::<aws_account_ID>:saml-provider/authentik",
          "arn:aws:iam::<aws_account_ID>:role/role_c,arn:aws:iam::<aws_account_ID>:saml-provider/authentik",
      ]

  4. Click Finish to save. Then, repeat the process to create a mapping for the user's session name:

    • Name: provide a descriptive name
    • SAML Attribute Name: https://aws.amazon.com/SAML/Attributes/RoleSessionName
    • Friendly Name: Leave blank
    • Expression: return user.username

  5. Click Finish.

Create an application and provider in authentik​

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Applications > Applications and click Create with Provider to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)

    • Application: provide a descriptive name (e.g. "AWS"), an optional group for the type of application, the policy engine mode, and optional UI settings. The slug will be used in URLs and should match the aws-slug placeholder defined earlier.
    • Choose a Provider type: select SAML Provider as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), and configure the following required settings:
      • Set the ACS URL to https://signin.aws.amazon.com/saml
      • Set the Audience to urn:amazon:webservices
      • Under Advanced protocol settings, add both property mappings you created in the previous section
      • NAME ID EDIT
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's My applications page.

  3. Click Submit to save the new application and provider.

note

The NameID field of type email is matched in AWS against the AWS username attribute, not the email attribute.

Download metadata file​

  1. Log into authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Applications > Providers and click on the name of the newly created AWS provider.
  3. Under Related objects > Metadata, click Download. This metadata file will be required in the next section.

AWS configuration​

  1. Log in to the AWS Management Console as an administrator that has permissions to create IAM roles and identity providers.
  2. Create an IAM role with the desired permissions and note the ARN.
  3. Navigate to IAM Identity Providers.
  4. Click Create Provider and configure:
    • Select SAML as the provider type.
    • Upload the metadata file from authentik.
  5. Add the property mappings to the SAML Provider.
  6. Create an application and assign the appropriate policies.
  7. Connect the provider to your application.

Resources​