River Styx for Azure AD allows organizations to govern access to AWS IAM Roles through Azure AD Group memberships, and provide users a friendly UI to access the console or retrieve STS tokens for each role.
Node >= 17.0.1 NPM >= 8.0.1 OpenSSL 3.0 or higher Azure CLI
To install Styx for Azure AD, you must first install and configure the Azure CLI ('az') with credentials for your target tenant. Once that is ready, use the following to install dependencies and initiate the deployment:
git clone https://github.com/c6fc/styx_azuread.git
cd styx_azuread
# Edit the settings file to set your tenant id
cp settings.jsonnet.example settings.jsonnet
vim settings.jsonnet
# Install npm dependencies, and start the deployment
npm install
npm run deploy
When the automatic provisioning is complete, it's necessary to manually generate a certificate for the Enterprise Application in Azure (Terraform can't do it automatically):
- Navigate to your tenancy in the Azure Portal
- Go to Azure Active Directory -> Enterprise applications -> River Styx -> Single sign-on
- Under card '3 - SAML Certficates', click 'Add a certificate'
- Accept the defaults ("Sign SAML assertion" and "SHA-256"), click 'New Certificate', and 'Save'.
Groups for Styx must follow a specific naming convention to be recognized by the integration:
AWS_123456789012_Developers
^ Account ^ Role name
Members of this group would be permitted to assume the role named 'Developers' in account '123456789012'.
- Navigate to your tenancy in Azure AD
- Azure Active Directory -> Groups
- Create a new group using the account id and role name it will govern access to
- Add users who should be permitted to access this role
- Navigate to Azure Active Directory -> Enterprise applications -> River Styx -> Users and Groups
- Click 'Add user/group' and add the group you just created to the application
- In your deployment account, navigate to the IAM console, and click 'Identity Providers' -> 'styx'
- Click the 'Download metadata' button, and save the file for later.
- In each destination account, navigate to the IAM console, and click 'Identity Providers'
- Click 'Add Provider'
- Use the provider type of 'SAML', enter the provider name as 'styx' (case sensitive), and upload the metadata document downloaded earlier.
- Click 'Add provider'
Once each destination account has the identity provider configured, you must then create any destination role that you plan to use.
- Navigate to the IAM console, and click 'Roles'
- Click 'Create Role'
- Select 'Custom Trust Policy' as the trusted entity type, and paste the contents of the
trust_policy.json
file. - Change the line in the trust policy to replace <account_id> with the account id of the account the role is being created in.
- Click 'next', add the permissions needed for the role, and click 'Next'
- Give the role a name based on the group you created for it, then click 'Create role'
This step assumes that you've already created the Azure AD Group associated with the role to be assumed.
- Open the target role in the AWS Console, click 'Trust relationships', and click 'Edit trust policy'
- Copy the object inside the 'statement' array from the
trust_policy.json
file, and add it to the statement array of the role's trust policy - Click 'Update Policy'
- Ensure that your user is a member of one or more role entitlement groups in Azure AD
- Navigate to your tenancy in Azure AD
- Azure Active Directory -> Enterprise applications -> Styx -> Single sign-on -> Test this application
- Ensure the 'Sign in as current user' radio option is selected, then click 'Test sign in'
- Users visit https://myapps.microsoft.com/
- Click the app shown as 'River Styx'
The process to remove Styx for Azure AD is similar to creating, you must first install and configure the Azure CLI ('az') with credentials for your target tenant. Once that is ready, use the following to install dependencies and run the destroy:
git clone https://github.com/c6fc/styx_azuread.git
cd styx_azuread
# Edit the settings file to set your tenant id
cp settings.jsonnet.example settings.jsonnet
vim settings.jsonnet
# Install npm dependencies, and run the destroy
npm install
npm run destroy