I'm setting up the AWS Application with collector and connector. I am able to successfully create a user in IGL and AFX creates the corresponding user in AWS. However the user in AWS doesn't have a password set(no login profile). I'm wondering how the community handles this? Did you do something in IGL or out of band to set the new user up with an initial password?
The AWS collector and connectors uses the Access Key and the Secret Key. You need to create a service account user and issue access keys with required IAM Roles
Have you referenced the datasheets?
RSA Identity Governance and Lifecycle Amazon AWS Collector Datasheet
RSA Identity Governance and Lifecycle Amazon AWS Connector Datasheet
Sorry if I was unclear. When the AWS connector performs the "Create an AmazonAWS account" it creates a user in AWS, for example jsmith. However it doesn't set or provide a password for jsmith. So how do you go about setting that password for jsmith? Is it a manual process outside of RSA IGL or is there some setting I am missing to set it in the connector.
Got it
Currently we support the CreateUser and AddUserToGroup operation on AWS.
CreateLoginProfile (setting the password on the new account) is unsupported and hence has to be manually created as far as I know.
Thank you for confirming CreateLoginProfile is not supported. That answers the question of whether my peers who use IGL do something within IGL or out of band.
My other question was "how does the community handle this"? I am still wondering what people do.
Do you have a scheduled task that checks for users without a login profile?
Do you have a lambda functioin that checks for users without a login profile?
Do your users go to your service desk to set the password manually via the console?
Though I haven't done this with AWS, but the concept is the same across different applications/connectors.
Just to augment to the above workaround, a simple AWS IAM API POST call can solve your problem for now.
https://iam.amazonaws.com/?Action=CreateLoginProfile&UserName=jdoe
&Password=Password$123&Version=2010-05-08&AUTHPARAMSUnfortunately deleting a user is much more complicated in AWS.
Got it
Currently we support the CreateUser and AddUserToGroup operation on AWS.
CreateLoginProfile (setting the password on the new account) is unsupported and hence has to be manually created as far as I know.