AWS Single Sign On - SSO

 

AWS SSO securely creates or connects your workforce identities and manages their access centrally across AWS accounts and applications.

For a single account, the users and group can be managed via IAM.

If there are multiple accounts managed through AWS Organization, manually creating users/groups across the accounts via IAM is tedious work.

AWS SSO is a solution for it. Where the user/group is created in AWS SSO and it can be assigned to the AWS Accounts.

NOTE:

* SSO can enabled in only one region.

* SSO is integrated with AWS Organization.

* AWS Organization must be used for SSO.

I have already set up AWS Organization - Please refer to AWS Organization

Let's enable SSO. 

We can log in using the AWS Access Portal URL.

Now, We will start creating a user.

The user is created.

Now, We will create a Permission Set. Permission sets define the level of access that users in IAM Identity Center have to their assigned AWS accounts.

 Under permission set, you can set the "Session Duration" - How long the session will be active.

Finally, We need to add the user to the AWS Account.

We are done with mapping the user with the account.

Let's log in and see if it works.

You must use the SSO URL.

Yay!! It works.