AWS singlesignon documentation change
Summary
Restructured and expanded the 'Getting Started' guide for IAM Identity Center, including reorganizing workflow steps, clarifying instance types (organization/account), identity source configuration, application access types, and sign-in processes.
Security assessment
The changes primarily reorganize documentation structure and clarify setup procedures. While there are references to security best practices (e.g., using groups for permissions), there is no evidence of addressing specific vulnerabilities or introducing new security features. The updates focus on usability and comprehensiveness rather than security remediation.
Diff
diff --git a/singlesignon/latest/userguide/getting-started.md b/singlesignon/latest/userguide/getting-started.md index 3ac56dd71..c75c36e79 100644 --- a//singlesignon/latest/userguide/getting-started.md +++ b//singlesignon/latest/userguide/getting-started.md @@ -5 +5 @@ -# Get started with common tasks in IAM Identity Center +# Getting started with IAM Identity Center @@ -7 +7 @@ -If you are a new user of IAM Identity Center, the basic workflow to get started using the service is: +The following outlines how you can get started with IAM Identity Center. @@ -9 +9 @@ If you are a new user of IAM Identity Center, the basic workflow to get started - 1. Sign in to the console of your management account if you are using an organization instance of IAM Identity Center or your AWS account if you are using an account instance of IAM Identity Center and navigate to the IAM Identity Center console. + 1. **Enable IAM Identity Center** @@ -11 +11 @@ If you are a new user of IAM Identity Center, the basic workflow to get started - 2. Select your identity source from the IAM Identity Center console. You can connect your existing identity source, such as an [external identity provider](./manage-your-identity-source-idp.html) or [Active Directory](./gs-ad.html). IAM Identity Center also provides you a directory by default that you can use to [configure user access](./quick-start-default-idc.html). +When you [enable IAM Identity Center](./enable-identity-center.html), you choose between two types of IAM Identity Center instances. These types are: [organization instances](./organization-instances-identity-center.html) (recommended) and [account instances](./account-instances-identity-center.html). To learn more about the different capabilities of these instance types, see [organization and account instances of IAM Identity Center](./identity-center-instances.html). @@ -13 +13 @@ If you are a new user of IAM Identity Center, the basic workflow to get started - 3. For organization instances, [assign user access to AWS accounts](./assignusers.html) by selecting the accounts in your organization, and then selecting users or groups from your directory and the permissions you want to grant them. +###### Note @@ -15 +15 @@ If you are a new user of IAM Identity Center, the basic workflow to get started - 4. Give users access to applications by: +After IAM Identity Center is enabled, you can sign in and open the [IAM Identity Center console ](https://console.aws.amazon.com/singlesignon/) by doing either of the following: @@ -17 +17 @@ If you are a new user of IAM Identity Center, the basic workflow to get started - 1. [Set up customer managed SAML 2.0 applications](./customermanagedapps-saml2-setup.html) by either electing one of the pre-integrated applications from the application catalog or adding your own SAML 2.0 application. + * **Organization instance** \- Sign in to AWS using credentials with administrative permissions in the management account. @@ -19 +19 @@ If you are a new user of IAM Identity Center, the basic workflow to get started - 2. Configure the application properties. + * **Account instance** \- Sign in to AWS using credentials with administrative permissions in the AWS account where IAM Identity Center is enabled. @@ -21 +21 @@ If you are a new user of IAM Identity Center, the basic workflow to get started - 3. [Assign the users access](./assignuserstoapp.html) to the application. We recommend that you assign user access through group membership rather than by adding individual user permissions. With groups you can grant or deny permissions to groups of users, instead of applying those permissions to each individual. If a user moves to a different organization, you simply move that user to a different group. The user then automatically receives the permissions that are needed for the new organization. + 2. **Connect your identity source to IAM Identity Center** @@ -23 +23 @@ If you are a new user of IAM Identity Center, the basic workflow to get started - 5. If you are using the default IAM Identity Center directory, tell your users how to sign in to the AWS access portal. New users in IAM Identity Center must activate their user credentials before they can be used to sign in to the AWS access portal. For more information, see [Sign in to the AWS access portal](https://docs.aws.amazon.com/signin/latest/userguide/iam-id-center-sign-in-tutorial.html) in the _AWS Sign-In User Guide_ +In IAM Identity Center console, confirm the identity source that you want to use. See the following for identity sources: @@ -24,0 +25 @@ If you are a new user of IAM Identity Center, the basic workflow to get started + * **External identity provider** \- If you have an existing identity provider to manage your workforce users, you can connect it to IAM Identity Center. For more information about how to configure commonly used identity providers to work with IAM Identity Center, see [IAM Identity Center identity source tutorials](./tutorials.html). @@ -25,0 +27 @@ If you are a new user of IAM Identity Center, the basic workflow to get started + * **Active Directory** \- If you're using Active Directory to manage your workforce users, you can connect it to IAM Identity Center. For more information, see [Using Active Directory as an identity source](./gs-ad.html). @@ -26,0 +29 @@ If you are a new user of IAM Identity Center, the basic workflow to get started + * **IAM Identity Center** \- Alternatively, you can [create and manage users and groups directly in IAM Identity Center](./quick-start-default-idc.html). @@ -28 +31 @@ If you are a new user of IAM Identity Center, the basic workflow to get started -The topics in this section help familiarize you with the common tasks performed after you have completed the initial configuration of IAM Identity Center. + 3. **Set up user access to AWS accounts (organization instance only)** @@ -30 +33 @@ The topics in this section help familiarize you with the common tasks performed -If you haven't enabled IAM Identity Center yet, see [Enable IAM Identity Center](./enable-identity-center.html). +If you’re using an organization instance of IAM Identity Center, you can [assign user or group access to AWS accounts](https://docs.aws.amazon.com/singlesignon/latest/userguide/assignusers.html), using [permission sets](https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html) to grant your users access to AWS accounts and resources. @@ -32 +35 @@ If you haven't enabled IAM Identity Center yet, see [Enable IAM Identity Center] -###### Topics + 4. **Set up user access to applications** @@ -34 +37 @@ If you haven't enabled IAM Identity Center yet, see [Enable IAM Identity Center] - * [Set up single sign-on access to your applications](./set-up-single-sign-on-access-to-applications.html) +With IAM Identity Center, you can grant users access to two types of applications: @@ -36 +39 @@ If you haven't enabled IAM Identity Center yet, see [Enable IAM Identity Center] - * [Create a permission set for job functions](./get-started-create-a-permission-set.html) + 1. **[AWS managed applications](./awsapps.html)** @@ -38 +41 @@ If you haven't enabled IAM Identity Center yet, see [Enable IAM Identity Center] - * [Assign AWS account access for an IAM Identity Center user](./get-started-assign-account-access-user.html) + * You can use IAM Identity Center with AWS managed applications like Amazon Q Business, AWS CLI, and Amazon Redshift. For more information, see [AWS managed applications](./awsapps.html) and [Integrating AWS CLI with IAM Identity Center](./integrating-aws-cli.html). @@ -40 +43 @@ If you haven't enabled IAM Identity Center yet, see [Enable IAM Identity Center] - * [Assign AWS account access for groups](./set-up-single-sign-on-access-to-accounts.html) + 2. **[Customer managed applications](./customermanagedapps.html)** @@ -42 +45 @@ If you haven't enabled IAM Identity Center yet, see [Enable IAM Identity Center] - * [View user and group assignments](./get-started-view-assignments.html) + * You can integrate either of the following types of customer managed applications with IAM Identity Center: @@ -44 +47,11 @@ If you haven't enabled IAM Identity Center yet, see [Enable IAM Identity Center] - * [Sign in to the AWS access portal with your IAM Identity Center credentials](./get-started-sign-in-access-portal.html) + * [Applications listed in IAM Identity Center catalog](./saasapps.html) + + * [Your custom applications](./customermanagedapps-set-up-your-own-app-saml2.html) + + * After configuring your application, you can [assign your users access to the application](./assignuserstoapp.html). + + 5. **Provide your users with sign-in instructions for the AWS access portal** + +The AWS access portal is a web portal that provides your users with seamless access to all their assigned applications, AWS accounts, or both. New users in IAM Identity Center must activate their user credentials before they can sign in to the AWS access portal. + +For information about how to sign in to the AWS access portal, see [Sign in to the AWS access portal](https://docs.aws.amazon.com/signin/latest/userguide/iam-id-center-sign-in-tutorial.html) in the _AWS Sign-In User Guide_. To learn about the sign-in process for the AWS access portal, see [Signing in to the AWS access portal](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtosignin.html). @@ -55 +68 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Update firewalls and gateways +What is IAM Identity Center? @@ -57 +70 @@ Update firewalls and gateways -Set up access to applications +IAM Identity Center prerequisites and considerations