Does IAM Federation with Google Workspace support user groups?

Question

Multiple blogs and documents suggested that a Google workspace user can be assumed to an IAM role.

However, is it possible to map a Google workspace user group with one or multiple IAM roles? If I understand correctly, IAM federation with Azure AD DC supports idp user group to iam role mapping. But not sure if the support is one-to-one or many-to-many type.

Thanks!

Answer

I don't think this is possible with G Suite, but haven't tried it myself.

The update to [this blog about using G Suite as an external IdP](https://aws.amazon.com/blogs/security/how-to-use-g-suite-as-external-identity-provider-aws-sso/) says:

> **May 4, 2021**: AWS Single Sign-On (SSO) currently does not support G Suite as an identity provider for automatic provisioning of users and groups, or the open source ssosync project, available on [Github](https://github.com/awslabs/ssosync).

Does IAM Federation with Google Workspace support user groups?

Contenuto pertinente