aws-samples / aws-iam-identity-center-sync-script

On Demand SCIM provisioning of Azure AD to AWS SSO with PowerShell

AWS IAM Identity Center Sync Script

Overview

On Demand SCIM provisioning of Azure AD to AWS IAM Identity Center with PowerShell

• This repo is based on the steps outlined in this article updated June 2023.

June 2023 Update

Made minor updates to the Configure section for Graph API Permissions

March 2022 Update

There is an updated version of this solution that uses Azure Functions and Keyvault to store the secrets in this article and repo is here

Getting Started

Prerequisites

Configure AWS IAM Identity Center with the steps outlined in this article

App Registration

Create

• Navigate to Azure Active Directory
• Open the App Registrations blade
• Choose New Registration
  • Name: [Example: AWS]
  • All other options remain default
• Choose Register
• Open the Certificates & secrets blade
• Choose New client secret
• Choose Add
• Copy the Value shown within Client Secrets

Configure

• Navigate to Azure Active Directory
• Open the App Registrations blade
• Choose the app created in the previous task
• Open the API Permissions blade
• Choose Add a permission
• Choose Microsoft Graph
• Choose Application permissions
• Scroll down to Application and expand
• Choose Application.ReadWrite.OwnedBy
• Choose Synchronization.ReadWrite.All
• Choose Add permissions
• Choose Grant admin consent for [Tenant Name]

Enterprise Application

• Navigate to Azure Active Directory
• Choose Enterprise applications blade
• Choose the app created in the previous task
• Choose Users and groups blade
• Choose Add user
• Choose Users
• Choose service account created in previous task
• Choose Assign

Inputs

Gather the following properties for input into the PowerShell script

• Navigate to Azure Active Directory
• Choose App Registrations blade
• Choose the app created in the previous task
• Copy the following values:
  • Tenant Id
  • Application Name
  • Application Id
  • Client Secret

Note: When copying and pasting in Windows, choose the PowerShell icon, then Edit > Paste.

License

This library is licensed under the MIT-0 License. See the LICENSE file.

aws-iam-identity-center-sync-script's Issues

Why PowerShell script when AzureAD supports SCIM for AWS SSO Out-of-the-box?

Hi,

Why PowerShell script when AzureAD supports SCIM for AWS SSO Out-of-the-box?

Any additional features/benefits to using this script over what's offered in the link below?

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/aws-single-sign-on-provisioning-tutorial

Thanks,

Graph API permissions clarification

The README mentions a permission called Synchronization.ReadWrite.OwnedBy, however, I don't find that API permission and instead Synchronization.ReadWrite.All, which I think can manage any application's synchronization configuration in the tenant.

I think clarification is needed. Thanks

401 errors from function app runtimes

Started seeing the 401 unauthorized errors. No updates or nothing has changed.

Error:

EXCEPTION: Response status code does not indicate success: 401 (Unauthorized). Exception : Type : Microsoft.PowerShell.Commands.HttpResponseException Response : StatusCode: 401, ReasonPhrase: 'Unauthorized', Version: 1.1, Content: System.Net.Http.HttpConnectionResponseContent, Headers: { Transfer-Encoding: chunked Strict-Transport-

Microsoft might have updated the graph api access fetch. Still looking into it.

Thanks