Understanding Automatic Provisioning with AWS IAM Identity Center

Introduction

Automatic provisioning in AWS IAM Identity Center streamlines user and group information management. This post breaks down this process, leveraging the System for Cross-domain Identity Management (SCIM) v2.0 protocol.

Key Concepts

• Automatic Provisioning: Sync user and group info from your identity provider (IdP) to IAM Identity Center using SCIM v2.0.
• SCIM Synchronization: Map IdP user attributes to IAM Identity Center attributes for compatibility.
• Configuration: Set up in your IdP using the SCIM endpoint and a bearer token from IAM Identity Center.

Topics Overview

1. Considerations for Using Automatic Provisioning

   • Unique primary email addresses are essential.
   • All users must have specified First name, Last name, Username, and Display name.
   • Third-party app integration might require additional mapping.
   • SCIM provisioning intervals depend on your IdP.
   • Multivalue attributes are not supported.
   • The externalId SCIM mapping must correspond to a unique, consistent value.
   • Users need assignment to an application or AWS account for synchronization.

2. Monitoring Access Token Expiry

   • SCIM tokens have a one-year validity.
   • AWS sends reminders for token rotation starting at 90 days before expiry.
   • Regular token rotation is crucial for uninterrupted service.

3. Enabling Automatic Provisioning

   • Access the IAM Identity Center console.
   • Navigate to Settings and enable automatic provisioning.
   • Copy the SCIM endpoint and access token for use in your IdP.

4. Disabling Automatic Provisioning

   • Access tokens must be deleted before disabling.
   • In the console, navigate to Settings > Identity source > Manage provisioning and disable the feature.

5. Generating a New Access Token

   • Requires automatic provisioning to be enabled.
   • Generate a new token via the IAM Identity Center console under Settings.

6. Deleting an Access Token

   • Select and delete the desired token in the IAM Identity Center console.

7. Rotating an Access Token

   • A directory supports up to two tokens.
   • Delete old tokens before generating new ones.
   • Update your IdP with the new token and test connectivity.

Conclusion

Understanding and effectively managing automatic provisioning in AWS IAM Identity Center is crucial for seamless user and group data synchronization. Familiarize yourself with these processes to ensure a secure and efficient cloud environment.