Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Automatiocaly sync users between Google workspace and AWS Identity center stop working

0

I have set up SAML and SCIM integration with Google Workspace at the AWS Identity Center. At the first configuration, the users were synced from Google to the AWS. I was able to manage them: by enabling users, attaching permissions sets and assigning users to the AWS accounts. After some time, I noted that new users from Google Workspace don't appear at AWS. I checked the AWS CloudTrail logs and didn't see anything. I asked for help from Google Workspace support and they confirmed that everything works well from their end. Since there are no logs in Google admin logs about the sync, they proposed that the issue be on the AWS side.
The Authentication users via SAML work well, and I can see that in Google Workspace logs.

My questions are the following:

  • Is it true that the AWS Identity Center initiates the sync of the users from Google Workspace?
  • If the problem is on the AWS side, how can I troubleshoot the issue, and how can I resume the sync?
  • Is there something else I need to know about using Google users for authentication?
Topics
Security, Identity, & Compliance
Tags
AWS IAM Identity Center
Language
English

asked 2 years ago887 views

1 Answer
0

To you first bullet, no, provisioning and updates are controlled by the identity provider, in this case Google Workspaces.

It's described in the Provisioning an external identity provider into IAM Identity Center using SCIM documentation under bullet 4, "SCIM provisioning and update intervals are controlled by your identity provider. Changes to users and groups in your identity provider are only reflected in IAM Identity Center after your identity provider sends those changes to IAM Identity Center."

In addition to those considerations in the previous link, there are also some considerations specifically related to Google Workspaces. For example users require First Name, Last Name, Username, and Display Name to be specified. I would review to ensure all the conditions are met for your users that aren't synced.

You might also want to review that the Access Token you used to configure the SCIM integration between Identity Center and Workspaces hasn't expired. See steps 4 and 5 in the Setup Google Workspaces with AWS IAM Identity Center documentation.

AWS

answered 2 years ago

  • Stanislav
    2 years ago

    Hi Trevor. I did what you listed above when I installed it for the first time. Users were created at the AWS Identity Center, and I was able to update parameters for some Active users, like their phone numbers at the IdP side (Google Workspace). However, other users were Deactivated at AWS, and new users did not appear.
    I checked the Google Workspace Web SAML application and found that I had defined the group name in the Provisioning scope settings. Attribute mapping has only the minimum required maps.

    The conclusions:
    I successfully set up the SAML/SCIM integrations between the Google Workspace and AWS Identity Center. Proof of this is that there are users in the AWS Identity Center who can authenticate to AWS with Google credentials. After some time, I decided to try the Optional feature of syncing the groups, which actually stopped the whole sync.

    Lesson learned: The optional feature can break your system/application/environmnet.

  • Trevor Schiavone
    2 years ago

    Hi Stanislav, yes that's correct in the second link I shared, Configure SAML and SCIM with Google Workspace - Considerations it's mentioned that:

    SCIM automatic synchronization from Google Workspace is currently limited to user provisioning. Automatic group provisioning is not supported at this time. Groups can be manually created with AWS CLI Identity Store create-group command or AWS Identity and Access Management (IAM) API CreateGroup. Alternatively, you can use ssosync to synchronize Google Workspace users and groups into IAM Identity Center.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content