Okta Identity Engine Upgrade Blocker with AWS Federation via AWS CLI
Last Updated:
Overview
The following reconfiguration has been identified as part of the preparation needed to perform the upgrade to Okta Identity Engine (OIE). Note that additional Okta features may require reconfiguration or be disabled in order to complete the upgrade. Community-developed tools that use the Amazon Web Services (AWS) Command Line Interface (CLI), such as gimme-aws-creds and saml2aws, stop functioning after an upgrade to Okta Identity Engine (OIE). These tools use classic authentication methods via the /authn API that are incompatible with OIE controls. Resolve this issue by switching to the Okta AWS CLI application or the AWS Identity and Access Management (IAM) Identity Center.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Amazon Web Services (AWS) Federation
- Amazon Web Services (AWS) Command Line Interface (CLI)
- USER_AGENT
Cause
Community-developed AWS CLI tools use classic authentication methods via the /authn API, which are incompatible with the controls and constraints enforced by OIE. Identify if these tools are in use within the System Log by executing the following queries.
"gimme-aws-creds""saml2aws""aws_okta_keyman""okta-awscli""fsdpt-cli""aws-login-tool"
Solution
What steps resolve the AWS CLI tool failure after an Okta Identity Engine upgrade?
Maintain CLI access after the upgrade by switching to the Okta AWS CLI application or the AWS IAM Identity Center.
-
Switch to the Okta AWS CLI application after upgrading to OIE. This application is built for the OIE framework and is compatible with its policies and access controls. The command line user experience is similar to the community created in regards to the user interface; however, it will be compatible with Okta Identity Engine policies and access controls as it is associated to an additional OIDC application. For the latest information, refer to the okta-aws-cli on the Okta GitHub.
NOTE: The okta-aws-cli application requires the OIE policy framework and cannot be fully tested in classic environments. Continue using the current solution until the upgrade is complete. To test the workstation configuration before the upgrade, refer to Testing okta-aws-cli before upgrade.
-
Switch to the AWS Identity and Access Management (IAM) Identity Center before upgrading to OIE. This web-based interface provides access to the Management console, which includes the Account/Role Picker and access via the Browser Embedded CLI. More information: AWS IAM Identity Center or AWS User Guide for Configuring Okta and IAM Identity Center
