AWS singlesignon medium security documentation change
Summary
Removed warning about automatic reprovisioning of deleted users from external identity sources and simplified provisioning documentation
Security assessment
The removed content previously warned administrators that deleting users in IAM Identity Center (when using external IdPs) would not prevent reprovisioning, which could lead to unintended persistent access if not properly managed. Removing this guidance increases risk of misconfiguration.
Diff
diff --git a/singlesignon/latest/userguide/users-groups-provisioning.md b/singlesignon/latest/userguide/users-groups-provisioning.md index db2bacd69..a759c4359 100644 --- a//singlesignon/latest/userguide/users-groups-provisioning.md +++ b//singlesignon/latest/userguide/users-groups-provisioning.md @@ -9,3 +9 @@ Username and email address uniquenessGroupsUser and group provisioningUser and g -IAM Identity Center enables you to control who can sign in and what resources they can access. A user must be provisioned to sign in. You can then assign access only to provisioned users or groups. - -Learn about provisioning users and groups, whether sourced from an external identity provider or created directly in IAM Identity Center. +IAM Identity Center enables you to control who can sign in and what resources they can access. A user must be provisioned to sign in. You can then assign access only to provisioned users or groups. Learn about users, groups, and provisioning in IAM Identity Center. @@ -31 +29 @@ Deprovisioning is the process of removing users and group information from IAM I -If you’re using Active Directory or an external identity provider with IAM Identity Center, you should remove users and groups from these identity sources rather than IAM Identity Center. Deleting IAM Identity Center users and groups will not completely remove them if your identity source is Active Directory or an external identity provider. If you’ve configured automatic provisioning of the users in your IdP to IAM Identity Center, these previously deleted users and groups will be reprovisioned in IAM Identity Center. +If you’re using Active Directory or an external identity provider with IAM Identity Center, you should remove users and groups from these identity sources rather than IAM Identity Center. Deleting IAM Identity Center users and groups will not completely remove them if your identity source is Active Directory or an external identity provider. @@ -41 +39 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Connect workforce users +Set up your workforce