QuickSight SSO, how to assign IAM roles to Azure AD group?
Hi,
we configured SSO for QuickSight and followed the instructions in this blog:
https://aws.amazon.com/de/blogs/big-data/enable-federation-to-amazon-quicksight-with-automatic-provisioning-of-users-between-aws-iam-identity-center-and-microsoft-azure-ad/
However, in this article every user will be an admin, because https://aws.amazon.com/SAML/Attributes/Role will always be mapped to arn:aws:iam:: <YourAWSAccount ID>:role/QuickSight-Admin-Role - the role does not depend on the user group.
- Le plus récent
- Le plus de votes
- La plupart des commentaires
Hi,
In Azure AD you need to map the https://aws.amazon.com/SAML/Attributes/Role claim to group value by doing some condition claim transformation rule. Therefore user member of Group Author will have a role claim https://aws.amazon.com/SAML/Attributes/Role of value Author.
Jeff
Contenus pertinents
- demandé il y a un an
- demandé il y a un an
- demandé il y a un an
AWS OFFICIELA mis à jour il y a 2 ans- AWS OFFICIELA mis à jour il y a 2 ans
- AWS OFFICIELA mis à jour il y a 3 mois
- AWS OFFICIELA mis à jour il y a un an
+1 for Jeff's opinion.
You need to specify the role to Assume to AWS when configuring SAML on Azure AD side.
Hi Jeff and isawa,
that is what we did in Azure AD. We created a claim named
https://aws.amazon.com/SAML/Attributes/Roleand used a claim condition to map the scoped group to the valuearn:aws:iam:: <Our Account ID>:saml-provider/IAM_Identity_Center, arn:aws:iam:: <Our Account ID>:role/<Name of the role we created for ADMIN/AUTHOR/READER>. However, we still get the error message invalid SAML response. When viewing the SAML response we see that the claims we created are not part of it. Are you sure that this works with Identity Center? We got some response in the blog https://aws.amazon.com/de/blogs/big-data/enable-federation-to-amazon-quicksight-with-automatic-provisioning-of-users-between-aws-iam-identity-center-and-microsoft-azure-ad/:Thank you Fabian. You can have only 1 IAM role for an Identity Center application at the moment. You could additionally create Author/Reader role with the policies which is given in "Configure IAM Policies" section and tie it up with different QuickSight applications in IAM Identity Center. This way, you could control which "user/user group" should have Admin/Author/Reader role.Does this mean we have to create 3 applications?