<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D50Z00008G7V34SAFOkta Classic EngineOkta Integration NetworkAnswered2024-06-30T11:31:02.000Z2018-01-03T09:18:29.000Z2020-10-13T17:22:53.000Z

YarinC.07754 (Customer) asked a question.

Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:19 AM
User restriction from AWS side
Is it possible to add to the Role policy on AWS  a condition that only specific users will be able to login to (through okta federation)?

The purpose is to prevent from someone with Active directory permissions or from Okta console with admin permissions, to assign himself to an admin group in AWS. 

So when he assign to the role it want work since the user is not included in the policy.
  • 3 answers
  • 1.41K views

  • matt.maher (Presales - Americas Commercial, Emerging East)

    Hi Yarin, you can assign specific AWS roles to Okta users which can limit their access to AWS. You can find details on how this can configured in our AWS and Okta Integration Guide (https://support.okta.com/help/servlet/fileField?retURL=/help/articles/Knowledge_Article/Amazon-Web-Services-and-Okta-Integration-Guide&entityId=ka0F0000000MeyyIAC&field=File_Attachment__Body__s). If you have any further questions specific to your integration I suggest you open a case with our support team.
    Expand Post

  • 1991a (1991a)

    Hi Yarin,

     

    I too had the same exact question and found a solution through much Googling and some experimentation. As I'm sure you discovered the problem is that accounts are not autoprovisioned in AWS so there is no IAM user that you can assign permissions directly to. The solution is the use the SAML userID (in email format) that is passed in from the SAML assertion.

     

    In the Okta-Admin role you setup in AWS modify the trust relationship (Edit Role - Trust Relationships - Conditions) and add a condition that looks at the SAML:sub attribute which is the SAML subject name which contains the actual user's email.

     

    Here is what I ended up adding.

     

           "ForAnyValue:StringLike": {

              "SAML:sub": [

                "emailaddress1",

                "emailaddress2"

              ]

            }

     

    Oh, and make sure you have an alternate way of logging in as an admin so you don't lock yourself out during testing and troubleshooting of the policy. ;-)

     

    Expand Post

  • 46vy1 (46vy1)

    Hello @matt.maher (Presales - Americas Commercial, Emerging East)​,

    I'm reviving this discussion.

    When using the new Okta + AWS SSO feature, how can one prevent an Okta admin from granting himself access to AWS?

    Also the link to the KB article you posted a while back doesn't work anymore. Is there something more up to date?

    Expand Post
This question is closed.
Loading
User restriction from AWS side