How to Integrate Okta with AWS IAM Identity Center to manage users, roles, and multi-account access
Published: 2024-01-17 19:00:00

<!-- wp:paragraph -->
<p>Okta is enterprise-grade software that is merely built for cloud applications. But its usage isn’t restricted to it, as many on-premises applications show compatibility with Okta. Managing user’s access to multiple devices and applications is now possible with the help of this enterprise-grade. In this technological world, everything has advanced so much that it is impossible to keep a track record. With advancement comes challenges like identity issues, employee mobility, security concerns, etc. Well, there is one solution to all these problems: <a href="https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/integrate-okta-with-aws-iam-identity-center-to-manage-users-roles-and-multi-account-access.html">Okta</a>.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 class="wp-block-heading"><strong>Features</strong></h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Although there are numerous features of Okta but the most prominent ones are:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Provisioning</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Single Sign-On</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Active Directory</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Multifactor Authentication</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><a href="https://www.okta.com/integrations/">Okta Integration Network (OIN)</a>&nbsp;is a pre-integrated network of applications. The most crucial role of this network is that it brings together all the features of Okta. Okta and IAM Identity Center go together. IAM Identity is a literal center that assists in managing single sign-on access to cloud applications and your AWS accounts. Moreover, it supports synchronization. It is the process of provisioning information from Okta to the Identity Center with the help of the SCIM 2.0 protocol.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 class="wp-block-heading"><strong>Benefits of integrating Okta with AWS for user and access management</strong></h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Before jumping on to the “How” part, we would like to discuss about the benefits that you will get after integrating Okta with AWS.</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>A single click is required by the users to perform a sign-in to IAM Identity Center</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>It provides mapping of authorized users to their relevant AWS resources and accounts</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>The groups having memberships in Okta will have their memberships moved to IAM Identity Center as well</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Developers will have two options for their sign-in; with Okta credentials or with <a href="https://www.okta.com/products/adaptive-multi-factor-authentication/">Okta Multi-factor Authentication</a></li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:heading -->
<h2 class="wp-block-heading"><strong>What is SSO (Single Sign On)?</strong></h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>After having a pretty good view at the introductory part, now is the time to get familiar with some basic terminologies. Let’s take a start from SSO.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The full form of SSO is Single Sign On. Meaning of this term is pretty self-explanatory but we will still explain it to you. So basically when a user uses a single set of sign-in credentials for accessing multiple applications then it can be called as SSO.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 class="wp-block-heading"><strong>Importance of integrating identity management in cloud environments</strong></h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Where cloud environments are super secure, they are also prone to many attacks. The priority should be to provide as much security to these environments as possible because one cannot afford to risk it at all.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>One way is to <a href="https://www.loginradius.com/blog/identity/identity-management-in-cloud-computing/">integrate the identity management in cloud environments</a>. There are numerous advantages of it, if you want to know a few of them then visit the below section.</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Connections of users is secure on the cloud as well as on-premises</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>A consistent and stable access control interface is provided to the users</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>High security layers and levels are offered</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Many businesses can access resources at fairly diverse level&nbsp;</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:heading -->
<h2 class="wp-block-heading"><strong>Prerequisites</strong></h2>
<!-- /wp:heading -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>You must own a developer’s account or a licensed Okta account</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>You must have administrative authority for managing permissions and users in Okta</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>An up and running AWS account</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>An administrative access to IAM Identity Center</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:heading -->
<h2 class="wp-block-heading"><strong>Architecture</strong></h2>
<!-- /wp:heading -->

<!-- wp:image -->
<figure class="wp-block-image"><img src="https://lh7-us.googleusercontent.com/YqeSPL0EfcFbgUaWU3AFkOKS-gCNflQERmVi7tNZIg1XZRV4ClYKH74GrWYlKtFSPPoTzKauaYYcXi-OY3XEo22Y-QF7NsIrPbQ6OM-hTRuZOnbPyHlBu_W9MLvDR7y8pTTIFUmw7bmICRGRWPx_cA" alt=""/></figure>
<!-- /wp:image -->

<!-- wp:heading -->
<h2 class="wp-block-heading"><strong>Integration Steps</strong></h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>There are two approaches to integrate Okta with AWS IAM Identity Center; CLI and console based. We will be discussing both of them down below.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 class="wp-block-heading"><strong>CLI Approach</strong></h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>One thing to remember regarding this approach is that the overall integration procedure cannot be done by only using the CLI commands. There have to be certain configurations that need to be made in the web consoles of Okta and AWS.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 class="wp-block-heading"><strong>AWS CLI Commands</strong></h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>First we will deal with the AWS CLI commands.</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><!-- wp:list-item -->
<li><strong>Installing AWS CLI</strong></li>
<!-- /wp:list-item --></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>You need to have AWS CLI version 2 installed as it shows compatibility with AWS SSO.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>For Linux</strong></p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"

unzip awscliv2.zip

sudo ./aws/install</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p><strong>For Windows</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>You have to install AWS CLI from <a href="https://awscli.amazonaws.com/AWSCLIV2.msi">here.</a><a href=""></a></p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true,"start":2} -->
<ol start="2"><!-- wp:list-item -->
<li><strong>Configuring AWS CLI</strong></li>
<!-- /wp:list-item --></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>You need to configure AWS CLI in order to use AWS SSO for the purpose of authentication</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code><em>aws configure sso</em></code></pre>
<!-- /wp:code -->

<!-- wp:list {"ordered":true,"start":3} -->
<ol start="3"><!-- wp:list-item -->
<li><strong>Signing-in using AWS SSO</strong></li>
<!-- /wp:list-item --></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Use the following command to perform a login</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code><em>aws sso login</em></code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>A new browser window will be opened for the completion of login process</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Okta CLI Commands</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Although AWS CLI commands are limited in scope but Okta CLI commands win this competition here.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><!-- wp:list-item -->
<li><strong>Installing Okta CLI</strong></li>
<!-- /wp:list-item --></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>The <a href="https://cli.okta.com/">installation of Okta</a> is different for every operating system that is why it is a good approach to visit its official documentation for this cause.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>For Windows</strong></p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code><em>choco install okta</em></code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p><strong>For Linux</strong></p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>-# Add Flathub repo

flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo

# install the package

flatpak install flathub com.okta.developer.CLI

# add this to your appropriate dot file

alias okta="flatpak run com.okta.developer.CLI"

curl https://raw.githubusercontent.com/okta/okta-cli/master/cli/src/main/scripts/install.sh | bash</code></pre>
<!-- /wp:code -->

<!-- wp:list {"ordered":true,"start":2} -->
<ol start="2"><!-- wp:list-item -->
<li><strong>Configuring Okta CLI</strong></li>
<!-- /wp:list-item --></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>The next step is to configure your Okta CLI with the API token and Okta domain.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code><em>okta login</em></code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p><strong>Additional Web Configurations</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The web configurations that need to be performed additionally are mentioned below.</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>You need to create an SAML 2.0 protocol application in Okta</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Importing SAML metadata in IAM Identity Center being exported from Okta</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Finally mapping Okta groups to the AWS roles</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Create a SAML 2.0 type Okta application and configure it with respect to AWS IAM Identity Center</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Note down the issuer URL and x509 certificate information of Okta application</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Now configure AWS IAM Identity Center in such a way that it works as an identity provider in Okta application</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Use the following command to create an identity provider corresponding to your Okta application in IAM Identity enter</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:code -->
<pre class="wp-block-code"><code>aws iam create-identity-provider

aws iam create-identity-provider --name okta --type SAML --attribute-mapping file://mapping.json --metadata file://metadata.xml</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Use aws iam enable-identity-provider-for-user command in order to enable the identity provider for users</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code><em>aws iam enable-identity-provider-for-user --user-name user1 --identity-provider-id okta</em></code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Now assign groups and users to the AWS IAM Identity Center application in Okta from Okta. This will perform the perfect synchronization of users between IAM Identity Center and Okta.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Console Approach</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Now let’s take things to a console based level, which is already available in <a href="https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/integrate-okta-with-aws-iam-identity-center-to-manage-users-roles-and-multi-account-access.html">documentation</a>. From setting up an Okta account to all of its advanced configurations, we will discuss everything.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Connect Okta with IAM Identity Center</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Perform a sign in to the <strong><em>AWS Management Console</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Open the console of <strong><em>IAM Identity Center</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose <strong><em>“Settings” </em></strong>option from the navigation pane</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:image {"id":33109,"sizeSlug":"full","linkDestination":"none"} -->
<figure class="wp-block-image size-full"><img src="https://sudoconsultants.com/wp-content/uploads/2024/01/image.png" alt="" class="wp-image-33109"/></figure>
<!-- /wp:image -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>As soon as you are directed to the Settings page, choose <strong><em>Identity Source</em></strong> tab</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose <strong><em>Change Identity Source</em></strong> from the <strong><em>Actions</em></strong> menu</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:image {"id":33110,"sizeSlug":"full","linkDestination":"none"} -->
<figure class="wp-block-image size-full"><img src="https://sudoconsultants.com/wp-content/uploads/2024/01/image-1.png" alt="" class="wp-image-33110"/></figure>
<!-- /wp:image -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Now choose<strong><em> External Identity Provider</em></strong> and click Next</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:image {"id":33111,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://sudoconsultants.com/wp-content/uploads/2024/01/image-2-1024x689.png" alt="" class="wp-image-33111"/></figure>
<!-- /wp:image -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Just below Service Provider Metadata, make sure to check the following values</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:list {"ordered":true} -->
<ol><!-- wp:list-item -->
<li>IAM Identity Center Assertion Consumer Service (ACS) URL</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>IAM Identity Center issuer URL</li>
<!-- /wp:list-item --></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>NOTE: Make sure to stay on the same page.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Create an IAM Identity Center Okta Application</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Open a new tab and perform a sign in to Okta console</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select <strong><em>Applications</em></strong> from the navigation pane</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>You will be directed to the Applications page. Click on <strong><em>Browse App Catalog</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Now search for AWS IAM Identity Center and choose <strong><em>Add Integration</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select <strong><em>Done</em></strong></li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Configure the IAM Identity Center Application in Okta</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Find and select <strong><em>Sign-on</em></strong> tab in the Okta console</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select <strong><em>“Edit”</em></strong> to edit the <strong><em>SAML settings</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Now copy and paste <strong>IAM Identity Center ACS URL </strong>and <strong>IAM Identity Center issuer </strong>URL under the <strong><em>Advanced Sign-on Settings</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Click on <strong>Save</strong></li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Upload SAML metadata from Okta to IAM Identity Center</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Click on the <strong>Sign-on</strong> tab present in the <strong><em>Okta console</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose <strong><em>Action</em></strong> under the <strong><em>SAML signing certificates</em></strong> and then select <strong><em>View Idp Metadata</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Save the file with the following extension: idp-saml.xml</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select <strong>Next, </strong>review the required changes and then confirm them</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Enable SCIM to synchronize users and groups</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Choose <strong><em>Settings</em></strong> from the navigation pane of <strong><em>IAM Identity Center Console</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Search for <strong><em>Automatic Provisioning</em></strong> and then select <strong><em>Enable</em></strong> under it</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>To access token to a text-editor copy the SCIM endpoints</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Create SCIM application to push users and groups to IAM Identity Center&nbsp;</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Click on <strong><em>Browse App Catalog</em></strong> present on the Application page of the Okta console</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>This time search for <strong><em>SCIM 2.0</em></strong> test app and choose <strong><em>Add integration</em></strong> option</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Navigate to the <strong><em>General Settings</em></strong> page and do the following:</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Enter SCIM 2.0 TestApp in the <strong><em>Application Label</em></strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Check the options saying: <strong><em>Do not display application icon to users</em></strong> and <strong><em>Do not display application icon in the Okta Mobile App</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select <strong><em>Next</em></strong> and then choose <strong><em>Done</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select Configure API Integration under the Provisioning Tab</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose the option <strong><em>Enable API Integration</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Enter the <strong><em>SCIM endpoint</em></strong> for <strong><em>SCIM 2.0 Base URL</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select <strong><em>Save</em></strong> and then <strong><em>Edit</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose the option <strong><em>Enable Create Users </em></strong>and then select <strong><em>Save</em></strong></li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Create a rule that pushes users and groups to IAM Identity Center</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Search for <strong><em>Push Groups</em></strong> tab in the <strong><em>Okta console</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select <strong><em>Find Groups by Rule</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Name the rule as <strong><em>AWS SSO Rule</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Use awssso as the prefix&nbsp;</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose <strong><em>Immediately push groups found by this rule</em></strong> and then select <strong><em>Create Rule</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Go to the navigation pane and choose <strong><em>Directory</em></strong>. After this select <strong><em>Groups</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose <strong><em>Add Group</em></strong> and fill the field with the following information:</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Name: AWS Users</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Select <strong><em>“Save”</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Now select <strong><em>AWS Users Group</em></strong> on the <strong><em>Groups page</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose <strong><em>Assign Applications</em></strong> on the <strong><em>Applications Tab</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select <strong><em>AWS IAM Identity Center Application </em></strong>and then select <strong><em>Assign</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose <strong><em>Assign</em></strong> for the <strong><em>SCIM 2.0 Test App</em></strong> and select <strong><em>Save</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose <strong><em>Done</em></strong></li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Create a New Group in Okta</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Choose <strong><em>Directory</em></strong> and then <strong><em>Groups</em></strong> from the navigation pane present on the <strong><em>Okta Console</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose <strong><em>Add Groups</em></strong> and enter a<strong><em>wsssoPowerUsers</em></strong> in the name field and select <strong><em>Save</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose <strong><em>Applications </em></strong>from the top navigation menu</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Open the SCIM 2.0 Test App application</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select Push Groups</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Notice that awssoPowerUsers is being listed and marked as Active</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>In the IAM Identity Center console, choose Groups from the navigation pane and see awsssoPowerUsers is being listed with no users</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Assign a Permission Set in IAM Identity Center</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>In the navigation pane of I<strong><em>AM Identity Console</em></strong>, select <strong><em>AWS accounts</em></strong> and choose your organization</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select all the accounts in the organization&nbsp;</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Now choose <strong><em>Assign users or groups</em></strong> and then select <strong><em>Groups</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select <strong><em>awsssoPowerUsers&nbsp;</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select <strong><em>“Next”</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose <strong><em>AWSPowerUsersAcces</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select <strong><em>Finish</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose <strong><em>Proceed to AWS Accounts</em></strong></li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Create a User in the Okta Portal</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>From the top navigation bar in Okta console, choose Directory and then People</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Select <strong><em>Add Person</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>On the relevant page, add the following information:</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:list {"ordered":true} -->
<ol><!-- wp:list-item -->
<li>Choose User for User Type</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Enter User’s First Name for First Name</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Enter User’s Last Name for Last Name</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Enter User’s email address for User Name</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Enter User’s email address for Primary email</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Enter awssoPowerUsers and AWS Users for Groups</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose set by admin and then enter password for Password</li>
<!-- /wp:list-item --></ol>
<!-- /wp:list -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Uncheck <strong><em>User must change password on first login</em></strong> and then select <strong><em>Save</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Now navigate to <strong><em>IAM Identity Center console</em></strong>&nbsp;</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>In the navigation pane choose <strong><em>Users</em></strong> and you will see the users created in the list&nbsp;</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Open <strong><em>General Information</em></strong> by choosing the <strong><em>User Name</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Make the confirmation that the user appears as <strong><em>CreatedBy:SCIM</em></strong></li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Verify the New User is Authenticated and has Access</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Open dashboard from the navigation pane of IAM Identity Console</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Copy the User Portal URL</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Make sure to open a new tab in a private mode</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Paste the copied URL in the address bar and you should be redirected to the Okta login page</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Fill in the required credential</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>You should be logged in successfully&nbsp;</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Verify the New User has Access to AWS account</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Choose <strong><em>AWS accounts</em></strong> in the <strong><em>IAM Identity Center Console</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose your organization’s management account</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose <strong><em>management console </em></strong>on the <strong><em>AWSPowerUserAccess</em></strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Make sure the AWS Management Console launches&nbsp;</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>So the process ends here, hope you had a great time reading this.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Conclusion</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The future of AWS IAM Identity Center and Okta is very vast. They hold great importance individually and on combined level as well. Advanced security layers and levels will be provided for managing the AWS accounts, resources and cloud environments. What else would a person want? Make sure to get the best out of it.</p>
<!-- /wp:paragraph -->