AWS singlesignon documentation change
Summary
Added details about configurable AD sync capabilities including data boundary control, access assignment options, and sync process management. Removed legacy AD sync behavior descriptions and restructured nested groups section.
Security assessment
The changes focus on feature enhancements (data boundary control, sync management) and documentation restructuring. While data boundary control has security implications, there is no explicit mention of addressing a vulnerability or security incident. The removed content relates to deprecated sync methods rather than security fixes.
Diff
diff --git a/singlesignon/latest/userguide/provision-users-from-ad-configurable-ADsync.md b/singlesignon/latest/userguide/provision-users-from-ad-configurable-ADsync.md index d89b370a9..1d9d32353 100644 --- a//singlesignon/latest/userguide/provision-users-from-ad-configurable-ADsync.md +++ b//singlesignon/latest/userguide/provision-users-from-ad-configurable-ADsync.md @@ -10,0 +11,11 @@ IAM Identity Center configurable Active Directory (AD) sync enables you to expli + * With this sync method, you can do the following: + + * Control data boundaries by explicitly defining the users and groups in Microsoft Active Directory that are automatically synchronized into IAM Identity Center. You can [add users and groups](./manage-sync-add-users-groups-configurable-ADsync.html) or [remove users and groups](./manage-sync-remove-users-groups-configurable-ADsync.html) to change the scope of the sync at any time. + + * Assign synchronized users and groups single sign-on [access to AWS accounts](./useraccess.html) or [access to applications](./assignuserstoapp.html). The applications can be AWS managed applications or customer managed applications. + + * Control the synchronization process by [pausing and resuming the sync](./manage-sync-pause-resume-sync-configurable-ADsync.html) as needed. This helps you regulate the load on production systems. + + + + @@ -19,2 +29,0 @@ Before you can use IAM Identity Center to assign new users and groups access to - * **AD sync** – When you make assignments for new users and groups by using the IAM Identity Center console or related assignment API actions, IAM Identity Center searches the domain controller directly for the specified users or groups, completes the assignment, and then periodically syncs the user or group metadata into IAM Identity Center. - @@ -32,3 +41 @@ Before you can use IAM Identity Center to assign new users and groups access to -Groups that are members of other groups are called _nested groups_ (or child groups). When you make assignments to a group in Active Directory that contains nested groups, the way in which the assignments are applied depends on whether you use AD sync or configurable AD sync. - - * **AD sync** – When you make assignments to a group in Active Directory that contains nested groups, only the direct members of the group can access the account. For example, if you assign access to Group A, and Group B is a member of Group A, only the direct members of Group A can access the account. No members of Group B inherit the access. +Groups that are members of other groups are called _nested groups_ (or child groups). @@ -42,2 +48,0 @@ If you have automated workflows that use the IAM Identity Center identity store - * **AD sync** – The process of assignments occurs first. You assign users and groups access to AWS accounts and to applications. After the users and groups are assigned access, they are automatically provisioned (synced into IAM Identity Center). If you have an automated workflow, this means that when you add a new user to Active Directory, your automated workflow can query Active Directory for the user by using the identity store `ListUser` API action, and then assign the user access by using the IAM Identity Center assignment API actions. Because the user has an assignment, that user is automatically provisioned into IAM Identity Center. - @@ -74 +79 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Provision users and groups from Active Directory +Mapping user attributes between IAM Identity Center and Microsoft AD directory