AWS singlesignon high security documentation change
Summary
Updated documentation to include group access, clarify management account selection, add MFA setup requirements, and note about external IdP MFA management
Security assessment
Added explicit instructions to enable MFA when using specific identity sources, which directly addresses authentication security. Notes about external IdP MFA management clarify security responsibilities.
Diff
diff --git a/singlesignon/latest/userguide/assignusers.md b/singlesignon/latest/userguide/assignusers.md index f99b6f814..5bf444c5d 100644 --- a//singlesignon/latest/userguide/assignusers.md +++ b//singlesignon/latest/userguide/assignusers.md @@ -5 +5 @@ -# Assign user access to AWS accounts +# Assign user or group access to AWS accounts @@ -9 +9 @@ Use the following procedure to assign single sign-on access to users and groups -To check existing user and group access, see [View user and group assignments](./get-started-view-assignments.html). +To check existing user and group access, see [View and change a permission set](./howtoviewandchangepermissionset.html). @@ -25 +25 @@ Make sure that the IAM Identity Center console is using the Region where your AW - 3. On the **AWS accounts** page, a tree view list of your organization appears. Select the check box next to one or more AWS accounts to which you want to assign single sign-on access. + 3. On the **AWS accounts** page, a tree view list of your organization displays. Select the checkbox next to the AWS account to which you want to assign access. If you are setting up administrative access for IAM Identity Center, select the checkbox next to the management account . @@ -63 +63 @@ To filter the results, start typing the name of the group that you want in the s -###### Important +###### Considerations @@ -65 +65 @@ To filter the results, start typing the name of the group that you want in the s -The user and group assignment process might take a few minutes to complete. Leave this page open until the process successfully completes. + * The user and group assignment process might take a few minutes to complete. Leave this page open until the process successfully completes. @@ -67 +67 @@ The user and group assignment process might take a few minutes to complete. Leav -###### Note + * ###### Note @@ -70,0 +71,12 @@ You might need to grant users or groups permissions to operate in the AWS Organi + 8. If either of the following applies, follow the steps in [Prompt users for MFA](./mfa-getting-started.html) to enable MFA for IAM Identity Center: + + * You're using the default Identity Center directory as your identity source. + + * You're using an AWS Managed Microsoft AD directory or a self-managed directory in Active Directory as your identity source and you're not using RADIUS MFA with AWS Directory Service. + +###### Note + +If you're using an external identity provider, note that the external IdP, not IAM Identity Center, manages MFA settings. MFA in IAM Identity Center is not supported for use by external IdPs. + + + @@ -71,0 +84 @@ You might need to grant users or groups permissions to operate in the AWS Organi +When you set up account access for the administrative user, IAM Identity Center creates a corresponding IAM role. This role, which is controlled by IAM Identity Center, is created in the relevant AWS account, and the policies specified in the permission set are attached to the role. @@ -72,0 +86 @@ You might need to grant users or groups permissions to operate in the AWS Organi +Alternatively, you can use [AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_SSO.html) to create and assign permission sets and assign users to those permission sets. Users can then [sign in to the AWS access portal](./howtosignin.html) or use [AWS Command Line Interface (AWS CLI)](https://docs.aws.amazon.com/singlesignon/latest/userguide/integrating-aws-cli.html) commands.