website/integrations/cloud-providers/aws-classic/index.mdx
import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs";
AWS, or Amazon Web Services, is a comprehensive cloud computing platform. It provides a wide array of on-demand IT services like computing power, storage, and databases, allowing businesses to build and run applications, and manage infrastructure through the internet.
The following placeholders are used in this guide:
authentik.company is the FQDN of the authentik installation.<aws_account_ID> is your AWS account ID (e.g., 123456789012).<provider_name> is the name you will set for the SAML provider in AWS (e.g., authentik).:::info This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. :::
AWS Classic IAM can be integrated with authentik via SAML or OIDC. Below are the steps to configure each method.
:::info SCIM Provisioning Limitation SCIM Provisioning is only supported in conjunction with IAM Identity Center, not Classic IAM. :::
<Tabs defaultValue="iam-saml" values={[ { label: "Classic IAM (SAML)", value: "iam-saml" }, { label: "Classic IAM (OIDC)", value: "iam-oidc" }, ]}> <TabItem value="iam-saml">
To support the integration of AWS with authentik via the Classic IAM method, you need to create two property mappings and an application/provider pair in authentik.
Log in to authentik as an administrator and open the authentik Admin interface.
Navigate to Customization > Property Mappings, click Create, select SAML Provider Property Mappings, and click Next.
Configure the first mapping for the user's role assignment:
Name: provide a descriptive name (e.g., AWS Role Mapping)
SAML Attribute Name: https://aws.amazon.com/SAML/Attributes/Role
Friendly Name: Leave blank
Expression: Choose one of these options:
For a static single role:
return "arn:aws:iam::<aws_account_ID>:role/authentik-admin,arn:aws:iam::<aws_account_ID>:saml-provider/<provider_name>"
For role assignment based on group membership (recommended):
ACCOUNT_ID = "<aws_account_ID>"
PROVIDER_NAME = "<provider_name>"
PREFIX = "AWS:"
# Collect the user's groups
group_names = list(user.groups.values_list("name", flat=True))
# Filter for groups starting with the prefix
roles = [
g[len(PREFIX):].strip()
for g in group_names
if g and g.casefold().startswith(PREFIX.casefold())
]
# Build entries. AWS expects a list of strings in this format where each line contains the role, then the provider name:
return [
f"arn:aws:iam::{ACCOUNT_ID}:role/{r},arn:aws:iam::{ACCOUNT_ID}:saml-provider/{PROVIDER_NAME}"
for r in roles
]
:::tip
With the group-based approach, create groups in authentik with names like AWS:authentik-admin, AWS:authentik-read-only, etc. Users assigned to these groups will automatically receive the corresponding AWS roles.
:::
For multiple static roles:
return [
"arn:aws:iam::<aws_account_ID>:role/authentik-admin,arn:aws:iam::<aws_account_ID>:saml-provider/<provider_name>",
"arn:aws:iam::<aws_account_ID>:role/authentik-read-only,arn:aws:iam::<aws_account_ID>:saml-provider/<provider_name>",
]
Click Finish to save. Then, repeat the process to create a mapping for the user's session name:
AWS Role Session Name)https://aws.amazon.com/SAML/Attributes/RoleSessionNamereturn user.username:::info
This mapping determines how the user will be identified in AWS audit logs and the AWS console. The username will appear in the format <role_name>/<username> in AWS.
:::
Click Finish.
Log in to authentik as an administrator and open the authentik Admin interface.
Navigate to Applications > Applications and click Create with Provider to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
AWS), an optional group for the type of application, the policy engine mode, and optional UI settings.https://signin.aws.amazon.com/samlurn:amazon:webservicesurn:amazon:webservicesPostClick Submit to save the new application and provider.
:::info NameID Format AWS Classic IAM uses the email-formatted NameID. The default authentik SAML email mapping is automatically included and does not need to be added manually. :::
SAMLauthentik). This must match the <provider_name> placeholder used in your property mappings.You will be redirected to the Identity providers home page.
For each role that users can assume via SAML (e.g., authentik-admin, authentik-read-only), you need to create a corresponding IAM role in AWS. The role names must match those specified in your authentik property mappings.
authentik).AdministratorAccess, ReadOnlyAccess, or custom policies).authentik-admin). This name must exactly match what you specified in the authentik property mappings.AWS automatically creates a trust policy for SAML federation, but it includes a unique session-specific ACS URL that needs to be updated to the generic signin URL.
Navigate back to IAM > Roles and click on the role you just created.
Go to the Trust relationships tab and click Edit trust policy.
You will see a policy similar to this:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRoleWithSAML",
"Principal": {
"Federated": "arn:aws:iam::123456789012:saml-provider/authentik"
},
"Condition": {
"StringEquals": {
"SAML:aud": ["https://signin.aws.amazon.com/saml/acs/AAAAAA"]
}
}
}
]
}
Update the SAML:aud value from the session-specific URL to the generic signin URL:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRoleWithSAML",
"Principal": {
"Federated": "arn:aws:iam::123456789012:saml-provider/authentik"
},
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}
:::info
The key change is replacing https://signin.aws.amazon.com/saml/acs/AAAAAA with https://signin.aws.amazon.com/saml. This allows any user authenticated through authentik to assume this role, regardless of their session.
:::
Click Update policy.
Repeat the role creation process for each role that you want to make available to your users.
<role_name>/<username> (e.g., authentik-admin/dominic).:::info AWS OIDC limitations AWS does not support direct OIDC login for the AWS Management Console.
OIDC in AWS is mainly used for federated access to AWS resources and programmatic access, such as:
- Machine-to-machine authentication (CI/CD pipelines, automated scripts, etc.)
- Web applications requesting temporary AWS credentials via OIDC tokens
- Service account integrations in Kubernetes clusters (like EKS OIDC provider)
:::
To support the integration of AWS with authentik using OIDC, you need to create an application/provider pair in authentik.
Log in to authentik as an administrator and open the authentik Admin interface.
Navigate to Applications > Applications and click Create with Provider to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
AWS-OIDC), an optional group for the type of application, the policy engine mode, and optional UI settings.Strict redirect URI to match the AWS resource that you want to access via OIDC.Click Submit to save the new application and provider.
OpenID Connecthttps://authentik.company/application/o/<application-slug>/