How do I use IAM Identity Center to set up SAML 2.0-based authentication for my Amazon Connect instance?

Resolution

Important: Complete the resolution steps in the same AWS Region that your Amazon Connect instance is in.

Create an Amazon Connect instance that uses SAML 2.0-based authentication

Create an Amazon Connect instance. When you configure the identity management for your instance, make sure that you choose SAML 2.0-based authentication. For the Telephony and Data storage sections, use the default options.

Create an IAM Identity Center cloud application to connect to your Amazon Connect instance

Create an IAM Identity Center cloud application to connect to your Amazon Connect instance. Make sure that you choose Amazon Connect as the cloud application's service provider. Under Application properties, accept the default Relay state.

Create an IAM IdP

Create an AWS Identity and Access Management (IAM) identity provider (IdP). For Provider name, enter ConnectIAM Identity Center. For Metadata document, choose the IAM Identity Center SAML metadata file that you downloaded in the previous section.

Important: Note the Amazon Resource Name (ARN) of the IdP. You need it to map your Amazon Connect instance's user attributes to IAM Identity Center attributes.

Create an IAM policy for your Amazon Connect instance that allows the GetFederationToken action

Create an IAM policy for your Amazon Connect instance that allows the GetFederationToken action.

Example policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1",
      "Effect": "Allow",
      "Action": "connect:GetFederationToken",
      "Resource": [
        "connect instance ARN/user/${aws:userid}"
      ]
    }
  ]
}

Note: Replace connect instance ARN with your Amazon Connect instance's ARN.

Create an IAM role that grants federated users access to your Amazon Connect instance

When you create the IAM role, make sure that you use the following configurations:

• For SAML provider, enter ConnectIAM Identity Center.
• Choose Allow programmatic and AWS Management Console access.
• For Policy, select the policy that you created in the previous section.
• For Role name, enter ConnectIAM-Identity-Center.

Important: Make note of the IAM role's ARN. You need it to map your Amazon Connect instance's user attributes to IAM Identity Center attributes.

Map your Amazon Connect instance's user attributes to IAM Identity Center attributes

When you map your attributes, add the following attributes and values:

• For the Subject attribute, use the ${user:email} value.
• For the https://aws.amazon.com/SAML/Attributes/RoleSessionName attribute, use the ${user:email} value.
• For the https://aws.amazon.com/SAML/Attributes/Role attribute, use the IAM role ARN, IAM IdP ARN value.
  Note: Replace IAM role ARN with your IAM role's ARN. Replace IAM IdP ARN with your IAM IdP's ARN.

Create users in IAM Identity Center and assign them to your IAM Identity Center cloud application

Create users in IAM Identity Center and assign them to your IAM Identity Center cloud application.

Test your setup

To test your setup, log in to Amazon Connect with your IdP and one of the IAM Identity Center user credentials that you created.

Related information

Troubleshoot SAML with Amazon Connect

Configure single sign-on for Amazon Connect using Okta