Case Study: Connecting Azure AD SSO with AWS
Tags: azuread, aws, sso, security
Published: 2022-11-19 06:30:18

## Introduction

We will learn how to connect Azure AD with AWS. We will use Azure AD as the identity provider, so Azure AD users will be used to log in to AWS. Let's dive deep into each component.

## Azure AD

I will not explain too much about Azure AD. I'll recommend reading [the documentation](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis) and [the home page of the Azure AD](https://azure.microsoft.com/en-us/products/active-directory/). In short, Azure AD (Azure Active Directory) is a cloud-based identity and access management service. You can use the identity provided by Azure AD for connecting various applications or services, including AWS. If you want to learn more about Azure AD, please visit the documentation.

## Azure AD SSO with AWS

For connecting Azure AD with AWS, we will need an Enterprise Application. Azure AD has an application gallery to provide a "template" for connecting Azure AD with another SaaS (Software as a Service). Application gallery will help us to create the Enterprise Application, and we can configure the Enterprise Application for [single sign-on (SSO)](https://learn.microsoft.com/en-us/azure/active-directory/develop/single-sign-on-saml-protocol) and [automated user provisioning](https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/user-provisioning). If you want to know more about the application gallery, you might need to read [this documentation](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/overview-application-gallery). But in this post, we will learn to set up the Enterprise Application and configure it for SSO.

We have two approaches to setting up the Enterprise Application. First, we use single AWS Apps to connect multiple AWS Accounts. Last, we create an AWS app for each AWS account.

### Single AWS Apps

Single AWS Apps is a model to centralize the configuration, and we only use one Enterprise App to connect multiple AWS Accounts. You will need this approach if you have a small amount of AWS Accounts and roles. We can't configure many AWS Accounts because there is a limitation for the manifest. In contrast, you will need Multiple AWS Apps for the case of large numbers of AWS Accounts.

![Single AWS App](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7ucjrgtqozk76ayarpf4.png)

### Multiple AWS Apps

Multiple AWS Apps is a model to map each AWS Account into one AWS Apps. The disadvantage of this model is we need to manage many apps and monitor each app. Other than that, we need to automate of each process to minimize wrong configurations.

Do you imagine how we update the signing certificate for 100 AWS Accounts manually? You will quickly be exhausted and upload the wrong configuration. After that, the SSO doesn't work.

It will become a nightmare if we can't automate the configuration. We are using MS Graph SDK and AWS SDK to solve that problem.

![Multiple AWS App](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9ej6cfl10lhf3twv8qbk.png)

### Flow

#### TLDR

In general, you only need to configure the Enterprise App, download the XML from the Enterprise App, upload the XML to AWS Identity Provider, and configure the roles to use the Identity Provider.

![tldr flow](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ryccyynm6a9u34ttppck.png)

#### Flow in Technical Term

You might need to see this diagram for details in technical terms.

![technical](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7z941998m6p40yro7qom.png)

## Repositories

Feel free to check this repository of my project. Please give feedback about this project because this project doesn't fully automate. I plan to have a "save" state and validation of the existing Enterprise App. Currently, the project is assumed to create a new Enterprise App.

{% github  bervProject/AzureADxAWSIntegrator %}

## Project Details

I use .NET as the main programming language. You can use different languages if you are more familiar with them as long as it's supported by the SDK/library.

![General View](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5axo25r75b9noy02gk5z.png)

I have 3 projects in this repository. The first project is responsible to connect with Microsoft Graph API. The second one is responsible to connect with AWS API. The last one is responsible to manage the business flow to connect both projects.

### Azure Integrator

Please see this diagram for the full steps of the Azure Integrator project.

![Azure Integrator](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tq41ru8j9ui6nxrd9azw.png)

### AWS Integrator

Please see this diagram for the full steps of the AWS Integrator project.

![AWS Integrator](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0sjvis969viq58lav0j6.png)

---

For more details, please refer to the documentation in the repository. I will keep the project up to date.

## Testing the SSO

1. Go to the [myapps.microsoft.com](https://myapps.microsoft.com). Click the AWS Icon.

    ![My Apps](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7phhvthkl4ty3vsn7ig9.png)

2. You will be redirected to AWS Dashboard. Please make sure your role and username are correct.

    ![AWS Dashboard](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m2csyefmbzgc63kb4vwf.png)

3. On my side, my account is allowed to see the EC2 instances. You can configure the role based on your needs.

    ![ec2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/q5dyjy5oovcmp7ztbqwc.png)




## Thank you

Thank you for reading. Feel free to give feedback for the process, project and this post.

![Thanks](https://media.giphy.com/media/nnZZfXUevHdz27aH7u/giphy.gif)

## References

### Main Resources

#### Azure AD (AAD)

- [Tutorials/Documentations from Microsoft](https://learn.microsoft.com/en-us/graph/application-saml-sso-configure-api?tabs=csharp)
- Permissions `Application.ReadWrite.All`, `AppRoleAssignment.ReadWrite.All`, `Policy.Read.All`, `Policy.ReadWrite.ApplicationConfiguration`, and `User.ReadWrite.All`.
- [App List Dashboard](https://myapps.microsoft.com/)

#### AWS

- [Simple cross-platform application using the AWS SDK for .NET](https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/quick-start-s3-1-cross.html)
- [AmazonIdentityManagementServiceClient](https://docs.aws.amazon.com/sdkfornet/v3/apidocs/items/IAM/TIAMServiceClient.html)
- [AmazonIdentityManagementServiceClient.CreateSAMLProvider](https://docs.aws.amazon.com/sdkfornet/v3/apidocs/items/IAM/MIAMServiceCreateSAMLProviderCreateSAMLProviderRequest.html)
- [AmazonIdentityManagementServiceClient.AttachRolePolicy](https://docs.aws.amazon.com/sdkfornet/v3/apidocs/items/IAM/MIAMServiceAttachRolePolicyAttachRolePolicyRequest.html)
- [AmazonIdentityManagementServiceClient.CreatePolicy](https://docs.aws.amazon.com/sdkfornet/v3/apidocs/items/IAM/MIAMServiceCreatePolicyCreatePolicyRequest.html)

### Setup SSO Manually - Single Account

- https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/amazon-web-service-tutorial

### Setup SSO Manually - Multiple Accounts

- https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/aws-multi-accounts-tutorial

### Another Topic - Provisioning

- https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/application-provisioning-configuration-api

### Another Code Samples

- https://learn.microsoft.com/en-us/samples/azure-samples/ms-identity-dotnetcore-galleryapp-management/automate-saml-based-sso-app-configuration-using-ms-graph-api-sdk-net/

### Tools/SDK Documentation

- [Microsoft Graph Client](https://learn.microsoft.com/en-us/graph/sdks/create-client?tabs=CS)
- [Authentication Provider for MS Graph](https://learn.microsoft.com/en-us/graph/sdks/choose-authentication-providers?tabs=CS#client-credentials-provider)