This article describes how to integrate AWS IAM Identity Center with RSA Cloud Access Service (CAS) using My Page SSO.

Configure CAS

Perform these steps to configure CAS using My Page SSO.
Procedure

1. Sign in to the RSA Cloud Administration Console with administrator credentials.
2. On the Applications > Application Catalog page, click Create From Template.
   
3. On the Choose Connector Template page, click Select for SAML Direct.
4. On the Basic Information page, choose Cloud.
5. Enter a name for the application in the Name field and click Next Step.
   
6. On the Connection Profile page, configure the values as specified in the following table.
   

   Field		Value/Description
   Initiate SAML Workflow		IdP-initiated
   Data Input Method		Import Metadata. Choose the metadata file downloaded from AWS.
   Assertion Consumer Service (ACS) URL		Automatically filled from the uploaded metadata file.
   Audience (Service Provider Entity ID)		Automatically filled from the uploaded metadata file.
   Identity Provider Advanced Configuration	Identity Provider Entity ID Source	Select Default: Identity Provider Entity ID.
   	Audience for SAML Response	Select Default: Service Provider Entity ID.
   Message Protection	SAML Response Protection	This will be automatically filled from the uploaded metadata. If not, choose IdP signs assertion within response.
   Connection Profile Advanced Configuration	User Identity > Name ID Format	emailAddress
   	User Identity > User Attribute for SAML Response Subject	mail

        
7. Click Next Step.
8. On the User Access page, select the access policy for authentication and click Next Step.
9. Change the options available on the Portal Display page as required and click Next Step.
10. Keep Fulfillment disabled unless using SCIM for provisioning.
11. Click Save and Finish.
12. Click Publish Changes.
13. Navigate to Applications > Applications and locate the newly created application.
14. Click Edit > Export Metadata to download the metadata.

Configure AWS IAM Identity Center

Perform these steps to configure AWS IAM Identity Center as a SAML Service provider to CAS.
Procedure

1. Log in to the AWS Management Console with admin credentials or as a root user.
2. Go to Settings > Identity source and click Actions > Change identity source.
   
3. Choose External identity provider, and then click Next.
4. Download the metadata under the Service provider metadata section, which will be used for RSA side configurations.
5. Under the Identity provider metadata section, choose the metadata file downloaded from RSA. (Do this step after finishing RSA side configurations.)
6. Click Next > Change Identity Source.
7. If SCIM provisioning is not enabled, create a new user and provide:
   • Username
   • first name
   • last name
   • display name
8. In the AWS IAM Identity Center console:
   1. Go to Multi-account permissions > Permission sets. 
      
   2. Click Create Permission set.
   3. Select Custom permission set, and then click Next.
   4. Select Inline policy to expand it, and then create a policy for the permission set using the following steps:
      1. Click Add new statement to create a policy statement.
      2. Under Edit statement, select Account from the list of services, and then add the following actions.
         • ListRegions
         • GetRegionOptStatus
         • DisableRegion
         • EnableRegion
      3. Next to Add a resource, click Add.
      4. On the Add resource page, under Resource type, select All Resources for the service Account, and then click Add resource.
      5. Verify that your policy looks like the following:
         
   5. Click Next.
   6. On the Specify permission set details page, specify a name under Permission set name (we have used RegionalAdmin), and then click Next.
   7. On the Review and create page, click Create. You should see RegionalAdmin displayed in the list of permission sets.
9. Under Multi-account permissions, choose AWS accounts.
10. Select the checkbox next to the account name (for example, Sandbox) where you want to grant user access to manage Regions, and then click Assign users and groups.
11. On the Select users and groups page, click the Users tab.
12. Select the checkbox next to the user, and then click Next.
13. Select the created permission, click Next, and then click Submit.

Notes

• Role attributes are used to implement Role-Based Access Control (RBAC), whereas session tags enable Attribute-Based Access Control (ABAC). Session tags can be combined with role attributes to provide more granular and flexible access management. For additional information, refer to the AWS documentation.
• Although session tags are automatically available during a session, they do not grant or deny permissions on their own. To use session tags for controlling access to resources through ABAC, appropriate policies are still required. In other words, session tags alone cannot enforce access controls without corresponding policy definitions. For more details, refer to the AWS documentation.
• If you prefer not to manage authorization policies within the user's IAM Identity Center Permission Set, you can implement tag-based access controls using resource-based policies instead. This approach allows resources to evaluate session tags directly when determining access. For more details, refer to the AWS documentation.

The configuration is complete.