4 ms·

That is one convoluted solution. Easier: Federate users to AWS using SAML https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-sa

That is one convoluted solution. Easier: Federate users to AWS using SAML https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-saml.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pr...

brian_herman__ 6y ago
It is like they created a solution specifically to have a blog post.
- hcazz 6y ago
  Agreed. Rolling your own login solution just to federate access to users seems really, really, unnecessary. There are a million other ways in AWS to accomplish the same task without writing any code, or leaving around a random lambda that will likely be forgotten in a few years.
  - moltar 6y ago
    I’ll be implementing something similar soon, and don’t want to overengineer it. Could you please list the top options and their pros and cons? Thank you in advance!
    - deleted 6y ago
      [deleted]
sneak 6y ago
SAML SSO setup is also one of the singlemost convoluted things most people need to do with AWS, but at least you only have to set it up once (per account). It’s basically a little mini-nightmare, at least when integrating it into G Suite. Burns a big chunk of a day.
- marcinzm 6y ago
  I've found it fairly easy to do on a new account with Okta and Terraform. Was probably a pain the first time (don't remember anymore) but it's been 99% automated after that.
  - busterarm 6y ago
    Yeah this was really difficult to wrap my head around and get right the first time (and with an old version of Okta's integration)...and I'm saying that having previously written my own SAML Identity Provider from scratch. It's a lot easier now though and especially now that I understand how it all works.
  - cactus2093 6y ago
    Okta is the only solution I've used that gives you the flexibility you need to make SSO not a nightmare. G Suite and Rippling are both very half-baked and integrations are often broken or the granularity you're looking for is not possible (they also both seem to treat SAML as a last resort and would rather push you to custom Oauth or other flows instead, making every integration work a little bit differently). There may be a few others like One Login where this is their entire business like Okta that are also good, I don't have experience with any others.
    - busterarm 6y ago
      G Suite works extremely well with Google Cloud at least. So much so that we don't bother with Okta there. The Okta logins are the G Suite emails anyway.
    - dkdk8283 6y ago
      Auth0 is also awesome
mdaniel 6y ago
Or OIDC, if SAML gives one a rash: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pr... The aws-vault project recently added support for AssumeRoleWithWebIdentity making it cheap to issue yourself disposable credentials: https://github.com/99designs/aws-vault/blob/v6.0.0-beta9/USAGE.md#assuming-roles-with-web-identities https://github.com/99designs/aws-vault/blob/v6.0.0-beta9/USA... including launching AWS Console links for those Roles: https://github.com/99designs/aws-vault/blob/v6.0.0-beta9/USAGE.md#logging-into-aws-console https://github.com/99designs/aws-vault/blob/v6.0.0-beta9/USA... Kind of speaking to the blog post's intention, I actually don't have any IAM Users in my AWS account
pnathan 6y ago
This is murder to do for the command line. IAM users are the right choice for CLI. edit: apparently aws sso assists here!
- avh02 6y ago
  There is some tooling around this that makes it a little less painful, for example with okta i use a tool [0] that i only have to worry about once a day usually, and it's not as painful as okta's own tooling. However, it does require some understanding, standardization, and general competence from those around you as well. [0] - https://github.com/jmhale/okta-awscli https://github.com/jmhale/okta-awscli
  - joombaga 6y ago
    I use this thing Nike made. Looks pretty similar. https://github.com/Nike-Inc/gimme-aws-creds https://github.com/Nike-Inc/gimme-aws-creds
- 0xEFF 6y ago
  Is this a significant differentiator with GCP? I log into gcloud with the same identity used by the web console and the rest of Gsuite. I read the article and wondered why they don’t simply grant object access to a group of users using their existing identity, but I’m not as familiar with AWS as I am with GCP.
- Xylakant 6y ago
  For interactive cli use (that is: a person sitting at a computer), SSO is directly supported. `aws sso login ` pops up the web browser, starts the sso login flow and temporary credentials are issued for the cli. Has been working pretty neat for us.
  - pnathan 6y ago
    I stand corrected, it seems like! Looks like it rolled out last Nov for the named profiles from the RSS feed. very happy to see work on this front!!
rajanpanchal 6y ago
What if the Idp is not SAML compliant

brian_herman__ 6y ago

It is like they created a solution specifically to have a blog post.

hcazz 6y ago
Agreed. Rolling your own login solution just to federate access to users seems really, really, unnecessary. There are a million other ways in AWS to accomplish the same task without writing any code, or leaving around a random lambda that will likely be forgotten in a few years.
- moltar 6y ago
  I’ll be implementing something similar soon, and don’t want to overengineer it. Could you please list the top options and their pros and cons? Thank you in advance!
  - deleted 6y ago
    [deleted]

sneak 6y ago

SAML SSO setup is also one of the singlemost convoluted things most people need to do with AWS, but at least you only have to set it up once (per account). It’s basically a little mini-nightmare, at least when integrating it into G Suite. Burns a big chunk of a day.

marcinzm 6y ago
I've found it fairly easy to do on a new account with Okta and Terraform. Was probably a pain the first time (don't remember anymore) but it's been 99% automated after that.
- busterarm 6y ago
  Yeah this was really difficult to wrap my head around and get right the first time (and with an old version of Okta's integration)...and I'm saying that having previously written my own SAML Identity Provider from scratch. It's a lot easier now though and especially now that I understand how it all works.
- cactus2093 6y ago
  Okta is the only solution I've used that gives you the flexibility you need to make SSO not a nightmare. G Suite and Rippling are both very half-baked and integrations are often broken or the granularity you're looking for is not possible (they also both seem to treat SAML as a last resort and would rather push you to custom Oauth or other flows instead, making every integration work a little bit differently). There may be a few others like One Login where this is their entire business like Okta that are also good, I don't have experience with any others.
  - busterarm 6y ago
    G Suite works extremely well with Google Cloud at least. So much so that we don't bother with Okta there. The Okta logins are the G Suite emails anyway.
  - dkdk8283 6y ago
    Auth0 is also awesome

mdaniel 6y ago

Or OIDC, if SAML gives one a rash: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pr... The aws-vault project recently added support for AssumeRoleWithWebIdentity making it cheap to issue yourself disposable credentials: https://github.com/99designs/aws-vault/blob/v6.0.0-beta9/USAGE.md#assuming-roles-with-web-identities https://github.com/99designs/aws-vault/blob/v6.0.0-beta9/USA... including launching AWS Console links for those Roles: https://github.com/99designs/aws-vault/blob/v6.0.0-beta9/USAGE.md#logging-into-aws-console https://github.com/99designs/aws-vault/blob/v6.0.0-beta9/USA... Kind of speaking to the blog post's intention, I actually don't have any IAM Users in my AWS account

pnathan 6y ago

This is murder to do for the command line. IAM users are the right choice for CLI. edit: apparently aws sso assists here!

avh02 6y ago
There is some tooling around this that makes it a little less painful, for example with okta i use a tool [0] that i only have to worry about once a day usually, and it's not as painful as okta's own tooling. However, it does require some understanding, standardization, and general competence from those around you as well. [0] - https://github.com/jmhale/okta-awscli https://github.com/jmhale/okta-awscli
- joombaga 6y ago
  I use this thing Nike made. Looks pretty similar. https://github.com/Nike-Inc/gimme-aws-creds https://github.com/Nike-Inc/gimme-aws-creds
0xEFF 6y ago
Is this a significant differentiator with GCP? I log into gcloud with the same identity used by the web console and the rest of Gsuite. I read the article and wondered why they don’t simply grant object access to a group of users using their existing identity, but I’m not as familiar with AWS as I am with GCP.
Xylakant 6y ago
For interactive cli use (that is: a person sitting at a computer), SSO is directly supported. `aws sso login ` pops up the web browser, starts the sso login flow and temporary credentials are issued for the cli. Has been working pretty neat for us.
- pnathan 6y ago
  I stand corrected, it seems like! Looks like it rolled out last Nov for the named profiles from the RSS feed. very happy to see work on this front!!

rajanpanchal 6y ago

What if the Idp is not SAML compliant