This article describes how to integrate Amazon Web Services (AWS) IAM with RSA Cloud Access Service (CAS) using My Page SSO.

Configure CAS

Perform these steps to configure RSA Cloud Authentication Service as an Identity provider to AWS IAM.
Procedure

1. Sign in to the RSA Cloud Administration Console.
2. Navigate to Applications > Application Catalog and search for Amazon Web Services.
3. Click Add to add the connector or click Create from Template. The latter option is used in this guide.
4. Click Select for SAML Direct and choose Cloud.
5. On the Basic Information page, enter the name for the application in the Name field and click Next Step.
   
6. On the Connection Profile page, configure the values shown in the following table. Retain the default values for all other settings.
      
   

   Field	Value
   Initiate SAML Workflow	IdP-initiated
   Data Input Method	Enter Manually
   Service Provider > Assertion Consumer Service (ACS) URL	https://signin.aws.amazon.com/saml
   Service Provider > Audience (Service Provider Entity ID)	urn:amazon:webservices
   Identity Provider > IdP Advanced Configuration	Default: Identity Provider Entity ID
   Message Protection > SAML Response Protection	IdP signs assertion within response
   Message Protection > Override default signing key and certificate	Signature Algorithm:RSA-SHA256,Digest Algorithm:SHA256
   Message Protection > Connection Profile Advanced Configuration	User Identity Name ID Format: persistent User Attribute for SAML Response Subject: mail Statement Attributes Attribute Name: https://aws.amazon.com/SAML/Attributes/RoleSessionName  Attribute Source: Identity Source Property: mail Attribute Name: https://aws.amazon.com/SAML/Attributes/Role  Attribute Source: Constant Property: arn:aws:iam::492411261048:role/RSAIAMRole,arn:aws:iam::492411261048:saml-provider/RSA arn:aws:iam::492411261048:role/ReadbillingRole,arn:aws:iam::492411261048:saml-provider/RSA (<ARN of the role assigned to provider in AWS>,<ARN of the provider created in AWS>)

Note on Role Attribute Mapping

In this example, two different Role ARN/Provider ARN combinations are mapped to a single https://aws.amazon.com/SAML/Attributes/Role attribute.

• You can map either a single Role ARN/Provider ARN value or multiple values to this attribute.
• When a federated user signs in to the AWS console and multiple role mappings are available, AWS presents the user with a role selection option.
• Access is granted only if the user satisfies the AWS trust policy criteria for the selected AWS role. AWS evaluates and enforces this trust policy.

7. Click Next Step.
8. On the User Access page, select the configured access policy and click Next Step.
9. On the Portal Display page, configure the portal display settings.
10. In the Application Tooltip field, enter a descriptive text about the application. The portal will display this text when a user hovers over the application’s icon.
11. On the Fulfillment page, make the required changes and click Save and Finish.
12. Click Publish Changes, then wait for the operation to complete.
13. Locate the newly created application in the applications list.
14. In the Edit drop-down list, select Export Metadata to download an XML file containing IdP metadata. This is required for AWS side configurations.

Notes

• If the values for Role ARN and Provider ARN are not known, enter placeholder values <RoleARN>, <ProviderARN> in the Property field to continue with the configuration. The actual value will be entered after completing the configuration of AWS IAM as the Service Provider.
• The selected attribute source is constant for testing purposes. These values can be sourced from the identity source.

Configure AWS IAM

Perform these steps to configure AWS IAM as a SAML service provider for CAS.

Procedure

1. Log in to the Identity and Access Management (IAM) console with an appropriate admin role or as a root user.
2. Select IAM.
3. In the left pane, click Identity Providers.
   
4. Click Add provider.
5. Choose SAML as Provider type.
   
6. Enter a name of your choice in the Provider Name field. In this example, the provider name is set to RSA.
7. In the Metadata Document field, select the IdP metadata file that you downloaded from RSA during the CAS configuration process.
8. Click Add provider.
9. Click the provider name you created, and then copy the Provider ARN displayed in the upper-right corner. Use this value for the attribute https://aws.amazon.com/SAML/Attributes/Role in your IdP settings.
   
10. Click Assign role.
11. Choose the Create a new role option.
    
12. In the Select Trusted Entity section, choose SAML 2.0 federation as the Trusted entity type.
13. In the SAML 2.0 federation section, choose the SAML provider created before in the SAML 2.0-based provider drop-down list.
    
14. Click Next.
15. In the Permissions policies section, select the permission policies you want for this role.
    
16. Click Next.
17. Enter role names, then click Create role. We have created two roles, namely RSAIAMRole and ReadBillingRole.
    
    
18. Click your created Role Name and copy the ARN, which you must use as one of the values of the attribute https://aws.amazon.com/SAML/Attributes/Role in your IDP settings. Perform this step for every role created.
    

The configuration is complete.