AWS singlesignon medium security documentation change
Summary
Rewrote sign-in instructions to focus on end-user experience, added details about one-time passwords (OTP) and verification codes, removed administrative configuration steps, and restructured content flow.
Security assessment
Added documentation about one-time passwords (OTP) for first-time sign-in and verification code requirements. These changes explicitly describe security features like temporary credentials and multi-factor authentication (MFA) workflows. The removal of root user/IAM credential usage recommendations also aligns with security best practices.
Diff
diff --git a/singlesignon/latest/userguide/howtosignin.md b/singlesignon/latest/userguide/howtosignin.md index 575f8bdc1..9c59da2f0 100644 --- a//singlesignon/latest/userguide/howtosignin.md +++ b//singlesignon/latest/userguide/howtosignin.md @@ -9 +9 @@ Sign in to the AWS access portalTrusted devicesSign in tips for the AWS access p -The AWS access portal provides IAM Identity Center users with single sign-on access to all their assigned AWS accounts and applications through a web portal. The following outlines how you can sign in to the AWS access portal, tips for signing in, and how to sign out of the AWS access portal. To learn how to sign in the AWS access portal as an IAM Identity Center user, see [Sign in to the AWS access portal](https://docs.aws.amazon.com/signin/latest/userguide/iam-id-center-sign-in-tutorial.html) in the _AWS Sign-in Guide_. +The AWS access portal provides IAM Identity Center users with single sign-on access to all their assigned AWS accounts and applications through a web portal. The following outlines how you can sign in to the AWS access portal, tips for signing in, and how to sign out of the AWS access portal. @@ -13 +13 @@ The AWS access portal provides IAM Identity Center users with single sign-on acc -IAM Identity Center needs to be enabled to use the AWS access portal. For more information, see [Enable IAM Identity Center](./enable-identity-center.html) +IAM Identity Center needs to be enabled to use the AWS access portal. For more information, see [Enable IAM Identity Center](./enable-identity-center.html). @@ -21 +21 @@ After you sign in, the default duration for your AWS access portal session is 8 -The following steps are for IAM Identity Center administrator to confirm that the IAM Identity Center user can sign in to the AWS access portal and access the AWS account. +###### To sign in to the AWS access portal @@ -23 +23 @@ The following steps are for IAM Identity Center administrator to confirm that th -###### Sign in to the AWS access portal + 1. In your browser window, paste in the sign-in URL that you were provided and choose **Enter**. The URL looks like `d-xxxxxxxxxx.awsapps.com/start` or ``your_subdomain`.awsapps.com/start`. We recommend that you bookmark this link to the portal now so that you can quickly access it later. @@ -25 +25 @@ The following steps are for IAM Identity Center administrator to confirm that th - 1. Do either of the following to sign in to the AWS Management Console. + 2. Sign in using your standard company sign in credentials. @@ -27,17 +27 @@ The following steps are for IAM Identity Center administrator to confirm that th - * **New to AWS (root user)** – Sign in as the account owner by choosing **Root user** and entering your AWS account email address. On the next page, enter your password. - - * **Already using AWS (IAM credentials)** – Sign in with your IAM credentials and select an admin role. - - 2. Open the [IAM Identity Center console](https://console.aws.amazon.com/singlesignon). - - 3. In the navigation pane, choose **Dashboard**. - - 4. On the **Dashboard** page, under **Settings summary** , choose the AWS access portal URL. - - 5. Sign in by using either of the following: - - * If you are using Active Directory or an external identity provider (IdP) as your identity source, sign in by using the credentials of the Active Directory or IdP user. - - * If you are using the default Identity Center directory as your identity source, sign in by using the username that you specified when you created the user and the new password that you specified for the user. - - 6. In the **Accounts** tab, locate your AWS account and expand it. +###### Note @@ -45 +29 @@ The following steps are for IAM Identity Center administrator to confirm that th - 7. The roles available to you are displayed. For example, if you are assigned both the **AdministratorAccess** permission set and **Billing** permissions sets, those roles are displayed in the AWS access portal. Choose the IAM role name you want to use for the session. +If your administrator sent you an email one-time password (OTP) and this is your first time signing in, enter that password. After you are signed in, you must create a new password for future sign-ins. @@ -47 +31 @@ The following steps are for IAM Identity Center administrator to confirm that th - 8. If you are redirected to the AWS Management Console you successfully finished setting up access to the AWS account. +If you are prompted for a **Verification code** , check your email and then copy and paste the code into the sign-in page. @@ -51,3 +35 @@ The following steps are for IAM Identity Center administrator to confirm that th -If you do not see any **AWS accounts** listed, it is likely that the user hasn't yet been assigned to a permission set for that account. For instructions on assigning users to a permission set, see [Assign user or group access to AWS accounts](./assignusers.html). - - +Verification codes are typically sent through email, but the delivery method can vary. Check with your administrator for details. @@ -54,0 +37 @@ If you do not see any **AWS accounts** listed, it is likely that the user hasn't + 3. Once signed in, you can access any AWS account and application that displays in the portal. @@ -56 +38,0 @@ If you do not see any **AWS accounts** listed, it is likely that the user hasn't -Now that you've confirmed that you can sign in using IAM Identity Center credentials, switch to the browser that you used to sign into the AWS Management Console and sign out from your root user or IAM user credentials. @@ -58 +39,0 @@ Now that you've confirmed that you can sign in using IAM Identity Center credent -###### Important @@ -60 +40,0 @@ Now that you've confirmed that you can sign in using IAM Identity Center credent -We strongly recommend that you use the credentials of the IAM Identity Center administrative user when you sign in to the AWS access portal to perform administrative tasks instead of using IAM user or root user credentials. Safeguard your root user credentials and use them to perform the tasks that only the root user can perform. To enable other users to access your accounts and applications, and to administer IAM Identity Center, create and assign permission sets only through IAM Identity Center. @@ -102 +82 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Activating the AWS access portal +Use the AWS access portal