AWS SAML Integration Guide

Before configuring AWS, download the SAML metadata from SplitSecure:

1. In SplitSecure, go to Secure Accounts → SAML2 Identity Providers
2. Click Details on the desired identity provider
3. Click Download Metadata to save the XML file

1. Sign in to the AWS Management Console
2. In the navigation pane, choose Identity providers
3. Click Add provider
4. Configure the provider:

5. Click Add provider

1. You can either:

• (If you are still in your Identity Provider’s page) at the top right of the page, click Assign role
• In the IAM console navigation pane, choose Roles. Then at the top right of the page, click Create role

2. Fill the form like so:

3. Click Next

{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Effect": "Allow",
           "Principal": {
               "Federated": "arn:aws:iam::894767036481:saml-provider/AWS-IS-AWESOME"
           },
           "Action": "sts:AssumeRoleWithSAML",
           "Condition": {
               "StringEquals": {
                   "SAML:aud": "https://signin.aws.amazon.com/saml/acs/SAMLSPAA1AA1AA1111AA1A"
               }
           }
       }
   ]
}

1. In SplitSecure, navigate to Secure Accounts → Create Account → AWS
2. Enter a name for your account
3. Select the Identity Provider used from which you took the metadata file
4. Enter the sign-in URL and the IAM Identity Provider ARN (which can be found at AWS Management Console IAM → Identity providers → Your IdP)
5. (Optional) In the default Role ARN field you can put the ARN found in the console at IAM → Roles → Your Role in the top corner

arn:aws:iam::111111111111:role/MyRole

6. Click Create Account

1. In SplitSecure, navigate to Secure Accounts
2. Locate your AWS account and click Authenticate
3. Choose your role, session name and session duration
4. Click Request Access
5. Complete the authentication flow