It is possible to connect Crowd to Amazon AWS IAM services
Asked by adiedler:

Hello,

We have to think about to connect our internal Crowd directory to AWS IAM services to use our internal credentials in the AWS ressources. Does anybody have any experiences about this topic to implement this configuration?

BR  
Alexander


Answers:
author: Steffen Opel _Utoolity_
body: Utoolity is offering an add-on family [Identity Federation for AWS](http://utoolity.net/products/identity-federation-for-aws) which implements an *Identity Broker* thatprovides *Federated AWS access for Atlassian users* , i.e. it allows to *Add long-term AWS security credentials (IAM users) once and configure AWS access for Atlassian groups with temporary credentials and fine grained permissions via IAM Policies thereafter* - this yields the following cross product features (on top of product specific ones):

* Single Sign-On (SSO) to the AWS Management Console
* REST API for temporary AWS Security Credentials

Cross Product Support {#toc-hId--1327770917}
--------------------------------------------

The add-on is conceptually designed and implemented as a cross product solution, however, the Atlassian Marketplace does not support commercial cross product add-on, which is why we need to offer it separately per product.

* It is currently available for [Bamboo](https://marketplace.atlassian.com/plugins/net.utoolity.atlassian.bamboo.identity-federation-for-aws-bamboo/server/overview) and [JIRA](https://marketplace.atlassian.com/plugins/net.utoolity.atlassian.jira.identity-federation-for-aws-jira/server/overview) due to the lack of dedicated use cases for Bitbucket and Confluence, but new add-ons on our roadmap will require those too and we would be happy to expedite this if there is resp. demand (see also our FAQ [Which Atlassian products are currently supported by Identity Federation for AWS?](https://utoolity.atlassian.net/wiki/questions/30900383/which-atlassian-products-are-currently-supported-by-identity-federation-for-aws)).

The main usage at this point is to provide the IAM based AWS security credentials backing for [Tasks for AWS](https://marketplace.atlassian.com/plugins/net.utoolity.atlassian.bamboo.tasks-for-aws/server/overview) (where it is included for free, see our resp. FAQ [Do I need an Identity Federation for AWS license when using it from another Utoolity add-on like Tasks for AWS?](https://utoolity.atlassian.net/wiki/questions/30900446/do-i-need-an-identity-federation-for-aws-license-when-using-it-from-another-utoolity-add-on-like-tasks-for-aws)).

That being said, we always considered its *Identity Broker* capabilities to be a notable standalone use case too, and we have several customers who indeed simply use [Identity Federation for AWS](http://utoolity.net/products/identity-federation-for-aws) as is to provide SSO to the AWS Management Console without the need to manage individual AWS credentials per user.

Crowd Support {#toc-hId--440267236}
-----------------------------------

[Identity Federation for AWS (JIRA)](https://marketplace.atlassian.com/plugins/net.utoolity.atlassian.jira.identity-federation-for-aws-jira/server/overview)work just fine with all common Crowd/JIRA integration scenarios outlined in [Connecting to Crowd or Another JIRA Server for User Management](https://confluence.atlassian.com/display/JIRA/Connecting+to+Crowd+or+Another+JIRA+Server+for+User+Management) - here's how we are [Connecting JIRA to Crowd](https://confluence.atlassian.com/display/JIRA/Connecting+to+Crowd+or+Another+JIRA+Server+for+User+Management#ConnectingtoCrowdorAnotherJIRAServerforUserManagement-ConnectingJIRAtoCrowd) for our own Atlassian suite:

* users are managed in Crowd
* JIRA (and other Atlassian applications) are linked to Crowd
* users log into JIRA (or any linked Atlassian product) via Crowd SSO
* users can then use SSO to AWS by means of Identity Federation for AWS (JIRA)

However, as per our resp. FAQ [Will Identity Federation for AWS be available for Atlassian Crowd?](https://utoolity.atlassian.net/wiki/questions/30900387/will-identity-federation-for-aws-be-available-for-atlassian-crowd), it is not available for Crowd itself :
> The add-on could work within Crowd in principle, however Crowd currently lacks the Universal Plugin Manager (UPM) and support for publishing Crowd add-ons via the Atlassian Marketplace in turn.

Please watch/vote/comment on the following Crowd issue to raise Atlassian's priority for addressing this limitation:

* <https://jira.atlassian.com/browse/CWD-3157>


author: Bruno Vincent
body: Hi Alexander,

AWS supports OpenID Connect (OIDC) and SAML 2.0 Identity Providers as detailed [here](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers.html). So your question is: "Can Crowd be a SAML 2.0 or OIDC IdP for AWS?". At the time of writing, the answer is no, but it could be done with a bit of coding:

* Crowd actually ships with CrowdID which is an OpenID 2.0 IdP. Unfortunately OpenID Connect is not supported yet. You might want to vote for this feature here: <https://jira.atlassian.com/browse/CWD-3995>
* Besides Crowd also ships with a SAML 2.0 connector but for Google Apps only: <https://confluence.atlassian.com/display/CROWD/Configuring+the+Google+Apps+Connector>  
  The Google Apps connector is a just plugin for Crowd so you could get inspired by it to create your own connector for AWS.

Best Regards,

Bruno


Tags: aws

crowd-administration