Single-Account Access for two or more AWS Accounts from Azure ID

Question

Hi All ,

I am wondering on how to add addtional SSO to a AWS account in Azure. I have done this successefuly with first AWS account but cant add another one.

1. I have created a new APP with a different name
2. Under SAML config (azure side) in the "Identifier (Entity ID)" and the "Reply URL (Assertion Consumer Service URL)" I have entered the "https://signin.aws.amazon.com/saml#1" value as mentioned in the following article: https://learn.microsoft.com/en-us/entra/identity/saas-apps/amazon-web-service-tutorial
3. I have created the Identity Provider in IAM on te second account exactly the same way as on first account.
4. Provisioning been set up as on my first account and it is works well.
5. When clicking on the new app for the seccond AWS account I am getting different errors depending on changes that I am doing on the "Identifier (Entity ID)" value. The error that I get now is 400. "Bad Request
You may have typed the address incorrectly or you may have used an outdated link.
Please clear your cookies and try the request again. If the problem persists, please contact Support. We apologize for the inconvenience."

What is the right way to achive this without using IAM Identity Center.

Thanks

Stas · Answer

I have just payd attantion that the error 400 happens when on the address bar I see: "https://signin.aws.amazon.com/saml#1" which is equl to the "Identifier (Entity ID)" value , which is proposed by the article: https://learn.microsoft.com/en-us/entra/identity/saas-apps/amazon-web-service-tutorial

Stas

answered 2 years ago

re:Post Agent · Answer

To set up Single Sign-On (SSO) for multiple AWS accounts from Azure AD without using AWS IAM Identity Center, you'll need to create separate enterprise applications in Azure AD for each AWS account. Here's the correct approach:

1. In Azure AD, create a new enterprise application for each AWS account you want to add. Give each application a unique name.

2. For each application, configure the SAML settings:
   - Set the "Identifier (Entity ID)" to "urn:amazon:webservices" (this should be the same for all AWS accounts).
   - The "Reply URL (Assertion Consumer Service URL)" should be "https://signin.aws.amazon.com/saml" (without the "#1" at the end).

3. In each AWS account, create a new SAML identity provider in IAM. Upload the Azure AD Federation Metadata XML file for the corresponding Azure AD application.

4. Create the necessary IAM roles in each AWS account that the federated users will assume.

5. In Azure AD, configure user and group assignments for each application to control who has access to which AWS account.

6. Set up the necessary SAML attributes in Azure AD to map to the AWS roles.

The error you're encountering (400 Bad Request) suggests there might be an issue with the SAML configuration, particularly the Identifier or Reply URL. Double-check these values and ensure they match exactly what's expected by AWS.

Remember, each AWS account needs its own separate enterprise application in Azure AD, but they all use the same base URL for sign-in. The differentiation between accounts happens through the SAML assertion and role mapping.

This approach allows you to maintain separate SSO configurations for multiple AWS accounts without using IAM Identity Center, giving you fine-grained control over access to each account.  
**Sources**  
[Using IAM access centre and federation in one account | AWS re:Post](https://repost.aws/questions/QUpdoXo1isS9a-4jMAbBHvBg/using-iam-access-centre-and-federation-in-one-account)  
[Integrate third-party SAML solution providers with AWS - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml_3rd-party.html)  
[Identity Provider over Identity Center? | AWS re:Post](https://repost.aws/questions/QUeuUZcXTdT_KDcLLWUIpt7w/identity-provider-over-identity-center)

Single-Account Access for two or more AWS Accounts from Azure ID

Add your answer

Relevant content