This article describes how to integrate RSA Cloud Access Service (CAS) with AWS IAM Identity Center using SAML Relying Party.

Configure CAS

Perform these steps to configure CAS as a Relying Party to AWS IAM Identity Center.
Procedure

1. Sign in to the RSA Cloud Administration Console.
2. Click Authentication Clients > Relying Parties.
   
3. On the My Relying Parties page, click Add a Relying Party.
4. On the Relying Party Catalog page, click Add for Service Provider SAML.
5. On the Basic Information page, enter a name for the application in the Name field and click Next Step.
6. On the Authentication page, choose RSA manages all authentication and click Next.
7. On the Connection Profile page, configure the values as specified in the following table and retain the remaining default values.
   

   Field		Value/Description
   Data Input Method		Import Metadata. Choose the metadata file downloaded from AWS.
   Assertion Consumer Service (ACS) URL		Automatically filled from the uploaded metadata file.
   Service Provider Entity ID		Automatically filled from the uploaded metadata file.
   Audience for SAML Response		Select Default: Service Provider Entity ID.
   Message Protection	SAML Response Protection	This will be automatically filled from the uploaded metadata. If not, choose IdP signs SAML assertions.
   SAML Response Protection		The value is auto-filled after uploading the metadata file. If not, choose IdP signs SAML assertions.
   Advanced Configurations	User Identity > Name ID > Identifier Type	Email Address
   	User Identity > Name ID > Property	mail

        
8. Click Save and Finish and click Publish Changes.
   After publishing, your application is enabled for SSO. 
9. On the My Relying Parties page, navigate to the newly created one.
10. In the Edit drop-down list, choose Metadata.

Configure AWS IAM Identity Center

Perform these steps to configure AWS IAM Identity Center as a SAML Service provider to CAS.
Procedure

1. Log in to the AWS Management Console with admin credentials or as a root user.
2. Go to Settings > Identity source and click Actions > Change identity source.
   
3. Choose External identity provider, and then click Next.
4. Download the metadata under the Service provider metadata section, which will be used for RSA side configurations.
5. Under the Identity provider metadata section, choose the metadata file downloaded from RSA. (Do this step after finishing RSA side configurations.)
6. Click Next > Change Identity Source.
7. If SCIM provisioning is not enabled, create a new user and provide:
   • Username
   • first name
   • last name
   • display name
8. In the AWS IAM Identity Center console:
   1. Go to Multi-account permissions > Permission sets. 
      
   2. Click Create Permission set.
   3. Select Custom permission set, and then click Next.
   4. Select Inline policy to expand it, and then create a policy for the permission set using the following steps:
      1. Click Add new statement to create a policy statement.
      2. Under Edit statement, select Account from the list of services, and then add the following actions.
         • ListRegions
         • GetRegionOptStatus
         • DisableRegion
         • EnableRegion
      3. Next to Add a resource, click Add.
      4. On the Add resource page, under Resource type, select All Resources for the service Account, and then click Add resource.
      5. Verify that your policy looks like the following:
         
   5. Click Next.
   6. On the Specify permission set details page, specify a name under Permission set name (we have used RegionalAdmin), and then click Next.
   7. On the Review and create page, click Create. You should see RegionalAdmin displayed in the list of permission sets.
9. Under Multi-account permissions, choose AWS accounts.
10. Select the checkbox next to the account name (for example, Sandbox) where you want to grant user access to manage Regions, and then click Assign users and groups.
11. On the Select users and groups page, click the Users tab.
12. Select the checkbox next to the user, and then click Next.
13. Select the created permission, click Next, and then click Submit.

Notes

• Role attributes are used to implement Role-Based Access Control (RBAC), whereas session tags enable Attribute-Based Access Control (ABAC). Session tags can be combined with role attributes to provide more granular and flexible access management. For additional information, refer to the AWS documentation.
• Although session tags are automatically available during a session, they do not grant or deny permissions on their own. To use session tags for controlling access to resources through ABAC, appropriate policies are still required. In other words, session tags alone cannot enforce access controls without corresponding policy definitions. For more details, refer to the AWS documentation.
• If you prefer not to manage authorization policies within the user's IAM Identity Center Permission Set, you can implement tag-based access controls using resource-based policies instead. This approach allows resources to evaluate session tags directly when determining access. For more details, refer to the AWS documentation.

The configuration is complete.