For the most recent update on ongoing service disruptions affecting the AWS Middle East (UAE) Region (ME-CENTRAL-1), refer to the AWS Health Dashboard. For information on AWS Service migration, see How do I migrate my services to another region?
Issue Configuring Amazon Q Business with IAM Identity Center and Microsoft Entra ID (Migrating to Cognito)
Hi,
We are currently attempting to configure Amazon Q Business with AWS IAM Identity Center using trusted identity propagation, following the steps outlined in the AWS Machine Learning Blog post: "https://aws.amazon.com/blogs/machine-learning/configuring-amazon-q-business-with-aws-iam-identity-center-trusted-identity-propagation/"
Initially, we were using Microsoft Entra ID as our OpenID Connect (OIDC) identity provider. We have encountered difficulties at the token exchange stage and are now migrating our approach to use Amazon Cognito as the OIDC provider instead.
Original Approach (Microsoft Entra ID - Failed):
We followed these steps using Microsoft Entra ID:
- Pasted the authorization URL into a web browser and signed in to Azure.
- Obtained the authorization code from the redirect URL.
- Exchanged the authorization code for an access token using the Entra ID token endpoint.
- Attempted to use the AWS CLI command aws sso-oidc create-token-with-iam to exchange the Entra ID token for an IAM Identity Center token. The exact command we used was:
aws sso-oidc create-token-with-iam --region us-east-1 --client-id "arn:aws:iam:::role/service-role/QBusiness-WebExperience" --grant-type authorization_code --code <authorization_code_obtained_from_entra_id> --redirect-uri <redirect_uri_used_in_authorization_request>
--client-id was set to ARN of AWS IAM role (execution role for Qbusiness). --grant-type was authorization_code. --code was the Auth code obtained from Entra ID. --redirect-uri was the same one configured in Entra ID app registration
We received the following error:
We suspect that the issue might be related to the configuration of the trusted token issuer or the audience/client ID mapping between Entra ID and IAM Identity Center. We verified the audience (aud) and issuer (iss) claims in the Entra ID token and confirmed that they matched the configured values in IAM Identity Center.
Current Approach (Migrating to Cognito):
- Given the difficulties with Entra ID, we are now shifting our focus to using Amazon Cognito as the OIDC provider. We plan to:
- Create a Cognito User Pool.
- Configure an App Client within the Cognito User Pool.
- Configure IAM Identity Center to trust Cognito as an OIDC provider.
- Modify our application to authenticate users via Cognito.
- Repeat the token exchange process using the Cognito-issued token.
Questions / Assistance Needed:
We would appreciate assistance with the following:
Confirmation of Cognito as a Suitable OIDC Provider: Is Amazon Cognito a fully supported and recommended OIDC provider for use with Amazon Q Business and IAM Identity Center trusted identity propagation? Are there any known limitations or considerations we should be aware of?
Cognito Configuration Guidance: Are there specific configuration steps or best practices we should follow when setting up Cognito as the OIDC provider for Q Business? Specifically, we are interested in:
Recommended claims to include in the Cognito ID token.
Any specific configurations required in the Cognito App Client.
Troubleshooting create-token-with-iam: Can you provide specific guidance on troubleshooting the aws sso-oidc create-token-with-iam command, especially in the context of using Cognito or identifying the root cause of the previous error with Entra ID (for future reference)? What are the common causes of failure for this command? What logging or debugging steps can we take?
IAM Role Requirements: Can you clarify the precise IAM permissions required for the IAM role used in the --client-id parameter of the create-token-with-iam command? What specific actions and resources are required? Is there a sample IAM policy that we can use as a starting point?
Sample Implementation (Cognito): Do you have any sample code or CloudFormation templates that demonstrate the complete integration of Amazon Q Business, IAM Identity Center, and Amazon Cognito using trusted identity propagation?
- Tags
- Amazon QAWS IAM Identity CenterAmazon CognitoAWS Identity and Access ManagementAmazon Q Business
- Language
- English
- Newest
- Most votes
- Most comments
Amazon Cognito is indeed a suitable and fully supported OIDC provider for use with Amazon Q Business and IAM Identity Center trusted identity propagation. It's a good choice for your migration from Microsoft Entra ID.
To set up Cognito as your OIDC provider for Q Business:
- Create a Cognito User Pool and configure an App Client within it.
- Set up SAML federation between IAM Identity Center and Cognito. This allows IAM Identity Center to act as the identity source for Cognito.
- Configure IAM Identity Center as a trusted token issuer for your Q Business application.
When configuring the Cognito App Client, ensure you enable the OAuth 2.0 grant types required for your application flow, typically including authorization code grant. Set the callback URL to match your application's redirect URI.
For the Cognito ID token, include standard claims like "sub" (subject), "iss" (issuer), and "aud" (audience). You may also want to include custom claims that map to IAM Identity Center attributes.
To troubleshoot the create-token-with-iam command:
- Verify the correct region is specified.
- Ensure the IAM role ARN in --client-id has the necessary permissions.
- Double-check that the authorization code and redirect URI match what was used in the initial authorization request.
- Examine the full error message for specific details on why the token exchange failed.
The IAM role used in --client-id should have permissions to assume the role and to call the necessary Q Business APIs. At a minimum, it needs the "sts:AssumeRole" permission and any specific actions required by Q Business.
For a complete implementation, you'll need to:
- Set up the Cognito User Pool and App Client.
- Configure SAML federation between IAM Identity Center and Cognito.
- Set up IAM Identity Center as a trusted token issuer.
- Implement the authentication flow in your application, including:
- Redirecting to Cognito for authentication
- Handling the callback with the authorization code
- Exchanging the code for Cognito tokens
- Using the Cognito ID token to get an IAM Identity Center token
- Using the IAM Identity Center token to assume an IAM role
- Making authenticated calls to Q Business APIs
While I don't have a specific sample implementation to share, you can find guidance on these steps in AWS documentation and blog posts. Remember to handle token refresh and error scenarios in your implementation.
Sources
How to implement trusted identity propagation for applications protected by Amazon Cognito | AWS Security Blog
Cognito and General Azure/Live ID Signin | AWS re:Post
Configure Amazon Q Business with AWS IAM Identity Center trusted identity propagation | AWS Machine Learning Blog
