This article describes how to integrate RSA Cloud Access Service (CAS) with AWS IAM Identity Center using SAML Relying Party.

Configure CAS

Perform these steps to configure CAS as a Relying Party to AWS IAM Identity Center.
Procedure

1. Sign in to the RSA Cloud Administration Console.
2. Click Authentication Clients > Relying Parties.
   
3. On the My Relying Parties page, click Add a Relying Party.
4. On the Relying Party Catalog page, click Add for Service Provider SAML.
   
5. On the Basic Information page, enter a name for the application in the Name field and click Next Step.
   
6. On the Authentication page, choose RSA manages all authentication.
7. In the 2.0 Access Policy for Authentication drop-down list, select a policy that was previously configured and click Next Step. 
   
8. On the Connection Profile page, click Import Data.
9. Click Choose File and select the file downloaded from the Service Provider.
   
10. In the SAML Response Protection section, choose IdP signs assertion within response, and download the certificate by clicking Download Certificate.
    
11. Scroll down to the User Identity section and select the following values:
    1. Identifier Type: Auto Detect
    2. Property: Auto Detect
       
       
12. Under the Statement Attributes section, add the following attributes:
    1. Attribute 1:
       1. Attribute Name: https://aws.amazon.com/SAML/Attributes/RoleSessionName
       2. Attribute Source: Identity Source
       3. Property: mail
    2. Attribute 2:
       1. Attribute Name: https://aws.amazon.com/SAML/Attributes/Role
       2. Attribute Source: Constant
       3. Property: AWS Role ARN value, AWS IAM instance session ARN value
          For example: Combine the Role ARN and the Provider ARN values, separated by a comma, to use as the Property value.
          arn:aws:sso:::instance/ssoins-7223fbc530cf9d85,arn:aws:iam::664847341240:role/RSA_Role1.
          
13. Refer to the Configure AWS IAM Identity Center section to obtain the AWS Role ARN and the AWS IAM instance session ARN values.
14. Go to the Message Protection section and choose IdP signs entire SAML response.
15. Click Save and Finish.
16. Click Publish Changes and wait for the operation to be completed.
    After publishing, your application is enabled for SSO. 
17. On the My Relying Parties page, navigate to the newly created one.
18. In the Edit drop-down list, choose Metadata.
    

Configure AWS IAM Identity Center

Perform these steps to configure CAS using My Page SSO.
Procedure

1. Access the AWS Management Console by logging in to your AWS account with admin credentials.
2. Under Services, go to Security, Identity, & Compliance, and select IAM Identity Center.
   
3. In the right pane, click Go to settings.
   
4. On the Identity Source tab, select Change identity source in the Actions drop-down list.
   
5. Choose External identity provider, and then click Next.
   
6. Configure the external identity provider and click Next.
   1. Service provider metadata: Click Download metadata file to download the SP metadata.
   2. IdP SAML metadata: Click Choose file and upload the metadata downloaded from RSA.
      
      
7. Review the list of changes. Once you are ready to proceed, type ACCEPT and click Change identity source.
   
8. Go to Settings and copy the Instance ARN for the RSA configuration (Attribute mapping). 
   
9. To create groups, navigate to AWS IAM.
   
10. Click IAM User groups, and then click Create group. 
    
11. In the User group name field, enter the name of the group, and then click Create user group.
    
    
12. To create a user, navigate to Access management > User, and click Create user.
    
13. Under User details, enter the username in the User name text box, and then click Next.
    
14. To create roles, navigate to Access Management > Roles, and then click Create role.
    
15. Choose SAML 2.0 federation as the Trusted entity type and enter a name for the SAML 2.0 trusted provider in the SAML 2.0-based provider field.
    
16. Copy the ARN. This is the same value as the AWS Role ARN value used in the RSA configuration (Attribute mapping).
17. Combine the Role ARN and the Provider ARN values, separated by a comma, to use as the Property value in RSA.
    

The configuration is complete.