AWS singlesignon documentation change
Summary
Added guidance to retain primary Region ACS URLs for SAML continuity and clarified endpoint requirements based on instance creation date.
Security assessment
Changes address operational continuity for SAML authentication but do not disclose or mitigate specific security vulnerabilities. The endpoint retention requirement relates to system availability rather than security weaknesses.
Diff
diff --git a/singlesignon/latest/userguide/multi-region-workforce-access.md b/singlesignon/latest/userguide/multi-region-workforce-access.md index 37d71675f..a429fbf4b 100644 --- a//singlesignon/latest/userguide/multi-region-workforce-access.md +++ b//singlesignon/latest/userguide/multi-region-workforce-access.md @@ -63 +63 @@ If you need to look up the ACS URLs or download them as part of the SAML metadat - 5. The **Service provider metadata** section displays the AWS access portal and ACS URL for each enabled Region. IPv4-only and dual-stack URLs are displayed in the respective tabs. If your IdP supports uploading the SAML metadata file, you can choose **Download metadata file** to download the SAML metadata file with all ACS URLs. If this is not supported, or you prefer to add them individually, you can copy individual ones from the table, or choose **View ACS URLs** and then **Copy all URLs**. + 5. The **Service provider metadata** section displays the AWS access portal and ACS URL for each enabled Region. IPv4-only and dual-stack URLs are displayed on separate tabs. If your IdP supports uploading a SAML metadata file, you can choose **Download metadata file** to download the SAML metadata file with all ACS URLs. If your IdP does not support uploading a metadata file, or you prefer to add ACS URLs individually, you can copy individual URLs from the table in the console, or choose **View ACS URLs** and then **Copy all URLs**. Retain the ACS URL that is already configured for the primary Region to ensure that service provider-initiated SAML single sign-on from the primary Region remains functional. @@ -76 +76 @@ Dual-stack | Yes | Yes | **Pattern:** `https://`[Region]`.sso.signin.aws/platfo -*IAM Identity Center no longer uses this endpoint for instances created starting in February 2026. While this endpoint remains available for earlier instances, we recommend using one of the other two endpoints instead. +* For instances that were enabled before February 2026, retain this endpoint because service provider-initiated SAML single sign-on to the primary Region requires it. IAM Identity Center does not use this endpoint for instances that were enabled in February 2026 or later.