awslabs / aws-iam-aad

This package includes a set of PowerShell scripts that run inside an AWS Fargate task and keep AWS IAM roles synchronized with Azure Active Directory roles. It is used to setup single-sign-on federation between Azure AD and AWS Management Console.

This code provides automated integration between AWS and Azure for SAML federation between Azure AD and multiple AWS accounts. You can read a detailed explanation about what it does and how it works in following AWS blog post:

https://aws.amazon.com/blogs/security/how-to-automate-saml-federation-to-multiple-aws-accounts-from-microsoft-azure-active-directory/

The solution is designed to make it easy to manage any number of AWS accounts in a way that integration efforts are not increased with number of accounts.

This solution includes an PowerShell script to automate ongoing changes in AWS that need to be updated in Azure AD, as well as a solution to easily deploy changes in AWS accounts without having to manually login to each account. You can read about details in the blog post.

aws-iam-aad's Issues

runtime is python2.7 (deprecated)

code in https://github.com/awslabs/aws-iam-aad/blob/master/cfn/saml-roles.json using runtime python 2.7, which will be deprecated soon

Announcing end of support for Python 2.7 in AWS Lambda
https://aws.amazon.com/blogs/compute/announcing-end-of-support-for-python-2-7-in-aws-lambda/

(<unknown>): found unknown escape character while parsing a quoted scalar

I got the following error while try to integrate the setup-env-cfn-template.json into a AWS Landing Zone AddOne:

`/codebuild/output/src736925300/src/aws-landing-zone-configuration/templates/azure-sso/setup-env-cfn-template.json

| FAIL FATAL
|
| (): found unknown escape character while parsing a quoted scalar at line 63 column 21 `

The Textblock which causes the error is the second line of:
"ZipFile": { "Fn::Join": ["", [ "\/**\n", "* A Lambda function that looks up the latest AMI ID for a given region and architecture.\n", "**\\/\n", "var aws = require(\"aws-sdk\");\n", "...",

I did not change the file above, I just try to add it into an custom add-on of the AWS Landing Zone Solution.

I hope you could help me.

Regards,
Philipp

Use existing AD Groups

Hi @SepehrCloud,

We have read your article How to automate SAML federation to multiple AWS accounts from Microsoft Azure Active Directory
/ and we are using this solution as an alternative for AWS SSO managed service since it is still not available on AWS China. Everything is setup and configured on our end and everything works as we followed the documentation. We just want to know if there is a way to use existing our AD groups instead of creating new groups per IAM role as this is our requirement? I'm still not adept with AD and SSO technologies that's why I have reached out on you.

Hope you help us out on this.

Thanks,
Mark

Cannot handle AWS ControlTower managed accounts

If you use AWS ControlTower to create and manage your AWS child/sub-accounts it creates different roles for StackSets. It seems like this repo will not working when the end user is leverage ControlTower (even though controltower uses aws organization, stacksets, etc...)

Module not found

After log into the ec2 as ec2-user, the following errors are shown -

Import-Module : The specified module 'AWSPowerShell.NetCore' was not loaded beca use no valid module file was found in any module directory.
At /home/ec2-user/scripts/setup/setup.ps1:26 char:1

• Import-Module -Name AWSPowerShell.NetCore
• CategoryInfo : ResourceUnavailable: (AWSPowerShell.NetCore:String) [I mport-Module], FileNotFoundException
• FullyQualifiedErrorId : Modules_ModuleNotFound,Microsoft.PowerShell.Commands.I mportModuleCommand