Integrate Amazon Web Services Using OpenID Connect in Okta
Last Updated:
Overview
Establishing an OpenID Connect (OIDC) connection between Okta and Amazon Web Services (AWS) Identity and Access Management (IAM) allows Okta to function as an enterprise identity provider for accessing an AWS application. Creating an OIDC web application in Okta and configuring the identity provider in AWS completes the integration.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- OpenID Connect (OIDC)
- Amazon Web Services (AWS)
Solution
Review the Prerequisites for the Integration
Ensure the Okta organization and Amazon Web Services account meet the requirements before beginning the integration.
- An Okta organization with API Access Management enabled for access to Custom Authorization Servers.
- An Amazon Web Services account with access to the Identity and Access Management (IAM) dashboard.
How is the OpenID Connect application created in Okta?
Create an OpenID Connect web application in the Okta Admin Console, configure the sign-in redirect Uniform Resource Identifier (URI), and retrieve the Client ID and discovery endpoint.
- Go to Applications > Applications in the Okta Admin Console.
- Click Create App Integration.
- Select OIDC - OpenID Connect as the sign-in method.
- Select Web Application as the application type and click Next.
- Enter a name for the application.
- Enter the Sign-in redirect URIs for the AWS-protected resource and add it to the Trusted Origins section.
- Choose the appropriate user assignments in the Assignments section.
- Click Save.
- Go to the General tab and copy the Client ID for use in AWS.
- Note the OpenID Connect discovery endpoint for the organization and authorization server. The endpoint uses the format
https://<example.okta.com>/oauth2/<auth_server_id>/.well-known/openid-configuration. For example, if using the "default" server, it will behttps://<example.okta.com>/oauth2/default/.well-known/openid-configuration.
On the AWS Side
Follow the steps provided in their support article Create an OpenID Connect (OIDC) identity provider in IAM, under the Prepare Smartsheet for the Okta/SCIM integration section.
