- [Instructor] It is common for organizations
to have multiple AWS accounts,
and cloud applications.
In such situations,
it becomes cumbersome for users to maintain
multiple login accounts,
and for administrators to manage user access
to multiple applications,
single sign-on in general,
is an authentication method that allows users
to authenticate to multiple applications
using just one set of credentials.
AWS Single Sign-on is a service
that allows you to centrally manage SSO access
to all of your AWS accounts,
and commonly used cloud applications
such as Salesforce, Box and Office 365.
AWS SSO integrates with AWS organizations.
You can use AWS SSO to sign into the accounts
you've configured under AWS organizations.
It also allows you to create,
and manage users and groups.
You can manage your users and groups directly
in the SSO console or connect to an existing
AWS Managed Microsoft Active Directory
to manage users with active directory
management tools.
It also allows you to use your existing
corporate entities.
AWS SSO integrates with Microsoft
Active Directory,
so your users can sign in using their
corporate active directory credentials.
We'll see this in an upcoming video.
AWS SSO coexist with existing IAM users,
roles and policies.
AWS SSO has no impact on the users, roles
or policies that you're already manage in IAM.
A few things to bear in mind
before configuring AWS SSO.
First, you must set up AWS Organizations.
Then sign in with the AWS Organizations
Management Account Credentials,
and determine the identity source to use.
This will determine which users
will have SSO access to the user portal.
You can need use the default SSO store
or connect to an external identity provider.
Now, let's switch to the AWS Management Console,
and configure SSO.
In this account,
I've already configured AWS organizations.
Use the services dropped down menu,
and navigate to the security identity
and compliance section,
and then go to AWS Single Sign-on.
If you do not have AWS SSO enabled,
you'll be prompted to enable it
before you can start managing it.
When you click enable AWS SSO,
it will create a service linked role
in all accounts within the organization.
This role allows AWS SSO to access
each account's resources on your behalf.
AWS SSO is now enabled.
Under settings,
you will see that the identity source
is set to AWS SSO.
You can change this to active directory
or an external identity provider.
This is the user portal URL
your users will use to access the SSO portal.
Here you can define multifactor
authentication behavior for your users.
Like when should they be prompted
for multifactor authentication?
When prompted,
what mechanisms can your users use?
If your user does not have a registered
MFA device,
should they be allowed to log in?
And who is allowed to manage MFA devices?
Users listed under the user section
will be able to use the SSO portal login.
Let's add a new user.
Enter a username and use the option
to generate a password.
Enter the email address, first name, last name,
and display name.
Click next.
Adding users to groups makes it easy
to manage permissions at scale.
Create a new group.
Provide a name and click create.
Select a group and click add user.
The user has been created.
Now, let's try to log in
with this user information.
And when you log in for the first time,
you will need to change the password.
We've logged in,
but the user does not have access
to any applications.
Back to the management account.
Let's grant permissions to the user.
On the left navigation pane,
click AWS accounts.
Doing so will list the accounts
in your organization.
Here you can configure the accounts
to which you'd like to grant access
to your users.
But before we do this,
let's create a permission set.
Permission sets are used to control access
for users and groups.
Click create permission set.
You can use an existing job function policy
to create a permission set or create a custom.
Job function include common ones
such as billing, network administrator,
database administrator and more.
Select create a custom permission set,
and click next.
Enter a name for the permission set.
Make a note of the message.
Your users will see this on the user portal,
and you cannot change this later.
Configure the session duration.
You can attach AWS managed policies
or create a custom permissions policy.
Select attach AWS managed policies.
From the list of policies,
select the desired wants to grant permissions
to users belonging to this group.
Notice that I've selected easy to full access.
On the next step,
add tags.
Click next.
Review your configuration and click create.
Now, let's configure the access.
Navigate back to AWS accounts,
and select the accounts
to which you would like to grant access.
Then click assign users.
Under the group tab,
select a group you configured earlier.
Select a permission set and click finish.
Time to test.
I'll navigate back to the browser window
where I'm logged in as the SSO user,
and refresh the page.
As you can see,
the user now has access to an AWS account.
Click the account,
and choose how you'd like to access it
using the Management Console
or Command Line.
From the Management Console,
I'll navigate to the EC2 services.
I'm able to view the EC2 resources
such as security groups.
Now, I'll navigate to the S3 Service.
Notice that I'm presented with an error message
that I do not have the permissions.
This is because the permission set associated
with this user only grants permissions
on the EC2 service.
If you'd like to grant similar access
to other users,
you just need to add them
to the group you created earlier.
Back to the management account,
the application section contains the enterprise
applications that you'd like to grant access
to your users via SSO.
Back to the management account,
the application section contains the enterprise
applications that you'd like to grant access
to your users via SSO.
To learn about how you can
configure your application access,
please refer to the SSO documentation.
As you've seen,
AWS SSO simplifies account management
for administrators and end users,
administrators can centrally
manage their identities
while end users can use a single portal
to access multiple accounts and applications.