How to configure AWS IAM Identity Center (SSO) with Okta or Azure AD for centralized access control?

Configure AWS IAM Identity Center (formerly SSO) to trust Okta or Azure AD by creating an external identity provider, mapping groups to IAM roles, and enabling attribute‑based access control. **Step‑by‑step implementation** 1. In the AWS console, go to **IAM Identity Center → Settings → Identity source** and select **External identity provider**. 2. Choose **SAML 2.0** and download the AWS metadata file. 3. In Okta or Azure AD, create a **SAML app** using the AWS metadata; set the **RelayState** to `https://[account-id].awsapps.com/start`. 4. Define attribute mappings: - `NameID` → `user.email` - `https://aws.amazon.com/SAML/Attributes/Role` → `${aws:principalTag/roleArn}` - `https://aws.amazon.com/SAML/Attributes/RoleSessionName` → `${user.email}` 5. In AWS CLI, create the identity source: ```bash aws sso-admin create-identity-source \ --instance-arn arn:aws:sso:::instance/ssoins-0123456789abcdef \ --identity-store-id \ --type SAML \ --saml-metadata-document file://aws-metadata.xml ``` 6. Create a permission set and attach policies: ```bash aws sso-admin create-permission-set \ --instance-arn $INSTANCE_ARN \ --name "ReadOnlyEC2" \ --description "Read‑only EC2 access" aws sso-admin attach-managed-policy-to-permission-set \ --instance-arn $INSTANCE_ARN \ --permission-set-arn $PERM_SET_ARN \ --managed-policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess ``` 7. Assign groups from the IdP to the permission set: ```bash aws sso-admin create-account-assignment \ --instance-arn $INSTANCE_ARN \ --target-id $AWS_ACCOUNT_ID \ --target-type AWS_ACCOUNT \ --permission-set-arn $PERM_SET_ARN \ --principal-type GROUP \ --principal-id ``` **Okta vs Azure AD (text table)** | Feature | Okta | Azure AD | |---|---|---| | SCIM provisioning | ✅ (user & group) | ✅ (user & group) | | SAML attribute mapping UI | Drag‑and‑drop | Pre‑defined templates | | Conditional access integration | ✅ | ✅ (Azure Conditional Access) | | Licensing cost per 1,000 users | Higher | Included with Azure AD Premium | **Gotcha:** Group membership changes in the IdP can take up to 15 minutes to propagate to IAM Identity Center; schedule a periodic `aws sso-admin list-account-assignments` audit to catch stale assignments.