AWS codecatalyst medium security documentation change
Summary
Added section for duplicate SSO user issue and resolution
Security assessment
Addresses a scenario where reusing deleted SSO usernames causes access conflicts, which could lead to unauthorized access or denial of service. The documentation explicitly warns about username reuse limitations and provides mitigation steps.
Diff
diff --git a/codecatalyst/latest/userguide/troubleshooting.md b/codecatalyst/latest/userguide/troubleshooting.md index 92934421f..a8d19a5e0 100644 --- a//codecatalyst/latest/userguide/troubleshooting.md +++ b//codecatalyst/latest/userguide/troubleshooting.md @@ -5 +5 @@ -Troubleshooting general access issuesTroubleshooting support issuesSome or all of Amazon CodeCatalyst isn't availableI can't create a project in CodeCatalystI can’t access my BID space as a new user or can’t be added as a new SSO user due to truncated user nameI want to submit feedback in CodeCatalyst +Troubleshooting general access issuesTroubleshooting support issuesSome or all of Amazon CodeCatalyst isn't availableI can't create a project in CodeCatalystI can’t access my BID space as a new user or can’t be added as a new SSO user due to truncated user nameAdding an SSO user to my federated space as a new user has created a duplicate userI want to submit feedback in CodeCatalyst @@ -22,0 +23,2 @@ The following information can help you troubleshoot common issues in CodeCatalys + * Adding an SSO user to my federated space as a new user has created a duplicate user + @@ -150,0 +153,19 @@ Even though the user name appears to be truncated, CodeCatalyst maps to identity +## Adding an SSO user to my federated space as a new user has created a duplicate user + +**Problem:** CodeCatalyst SSO users added to a CodeCatalyst space and then removed might experience an issue where the user name attempts reuse. This might result in an error similar to the following, where the user is not allowed to be duplicated even though it was re-created. + +**`Unable to assume role`** + +`To access support cases, you must add the role AWSRoleForCodeCatalystSupport to the AWS account that is the billing account for the space.` + +**Possible fixes:** If an existing IDC user is deleted and then a new user is recreate with the same username, then the new user is not able to log in due to the username conflicting with the old user. After a user name is added to a space as an SSO user, the name cannot be used again. Any users that sign up with a AWS Builder ID or are added in IAM Identity Center after that will not be able to sign in because the name will appear to be a duplicate. + +Depending on the type of space, do one of the following: + + * To be able to sign in to the AWS Builder ID space, sign up with a different user name. + + * To be able to add the new user in IAM Identity Center, add the user with a different user name. + + + +