How to create SAML providers with AWS CloudFormation

Amazon Web Services Feed
How to create SAML providers with AWS CloudFormation

As organizations grow, they often experience an inflection point where it becomes impractical to manually manage separate user accounts in disparate systems. Managing multiple AWS accounts is no exception. Many large organizations have dozens or even hundreds of AWS accounts spread across multiple business units.

AWS provides many solutions that can orchestrate a person’s identity across multiple accounts. AWS Identity and Access Management (IAM), SAML, and OpenID can all help. The solution I describe in this post uses these features and services and can scale to thousands of AWS accounts. It provides a repeatable and automated means for deploying a unified identity management structure across all of your AWS environments. It does this while extending existing identity management into AWS without needing to change your current sources of user information.

About multi-account management

This approach uses AWS CloudFormation StackSets to deploy an identity provider and AWS IAM roles into multiple accounts. Roles may be tailored for your business needs and mapped to administrators, power users, or highly specialized roles that perform domain-specific tasks within your environment. StackSets are a highly scalable tool for multi-account orchestration and enforcement of policies across an organization.

Before deploying this solution across your organization, I recommend that you deploy the stack below into a single AWS account for testing purposes. Then, extend the solution using StackSets across your organization once tested. For more information about AWS CloudFormation Stacks and StackSets, see our documentation.

About SAML and SAML providers

Security Assertion Markup Language 2.0 (SAML) is an open standard for exchanging identity and security information with applications and other external systems. For example, if your organization uses Microsoft Active Directory, you can federate your user accounts to other organizations by way of SAML assertions. Actions that users take in the external organization can then be mapped to the identity of the original user and executed with a role that has predetermined privileges.

If you’re new to SAML, don’t worry! Not only is it ubiquitous, it’s also well documented. Many websites use it to drive their security and infrastructure, and you may have already used it without knowing it. For more information about SAML and AWS, I suggest you start with Enabling SAML for Your AWS Resources.

Properly configured SAML federation provides core security requirements for authentication and authorization, while maintaining a single source of truth for who your users are. It also enables important constraints such as multi-factor authentication and centralized access management. Within AWS IAM, you setup a SAML trust by configuring your identity provider with information about AWS and the AWS IAM roles that you want your federated users to use. SAML is secured using public key authentication.

This solution is a companion to the blog post AWS Federated Authentication with Active Directory Federation Services (AD FS), but it can be applied to any SAML provider.

Solution overview

To orchestrate SAML providers across multiple accounts, you will need the following:

• A basic understanding of federated users.
• An identity provider that supports SAML, such as Active Directory Federation Services (AD FS), or Shibboleth.
• An Amazon Simple Storage Service (Amazon S3) bucket to host the provider’s federation metadata file.
• An AWS account that can create StackSets in other accounts. Usually, this is an AWS Organizations master account, with StackSets provisioned into member accounts. See the AWS Organizations User Guide for more details.

Note: You can adapt this solution to retrieve federation metadata from a HTTPS endpoint, such as those published by publicly hosted identity providers, but this solution does not currently offer that.

At this time, CloudFormation does not directly support provisioning a SAML provider. However, you can accomplish this by using a custom resource Lambda function. The sample code provided in this post takes this one step further and deploys your federation metadata from a secure Amazon S3 bucket, as some organizations have requirements about how this metadata is stored.
 

Figure 1: Architecture diagram

Here’s what the solution architecture looks like, as shown in Figure 1:

1. An AWS CloudFormation template is created within an AWS account. Most commonly this is your master account within AWS Organizations, but it can be a standalone account as well.
2. The AWS CloudFormation template is deployed to other AWS accounts within your organization using AWS CloudFormation StackSets.
3. The AWS CloudFormation StackSet creates the following resources:
   1. A new read-only role within AWS IAM that uses the new identity provider as the principal in the IAM role’s trust policy. This is a sample that I use to demonstrate how you can deploy IAM Roles that are bound to a single, dedicated identity provider.
   2. An execution role for a custom resource AWS Lambda function.
   3. The AWS Lambda function, which creates the identity provider within the destination account.
4. The new AWS Lambda function is executed, pulling your federation metadata from the master account’s S3 Bucket and creating the new Identity Provider.

Step 1: Upload your federation metadata to a restricted S3 bucket

To ensure that your SAML provider’s federation metadata is exposed only to accounts within your AWS organization, you can upload the metadata to an Amazon S3 bucket and then restrict access to accounts within your organization. The bucket policy follows this template:

{ "Version": "2012-10-17", "Id": "Policy1545178796950", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::<replace with bucket name>/*", "Condition": { "StringEquals": { "aws:PrincipalOrgID": "<replace with organization ID>" } } } ]
}

Once this Amazon S3 bucket policy is in place, upload your federation metadata document to the bucket and note the object URL.

If your organization can share your federation metadata publicly, then there’s no need for this bucket policy. Simply upload your file to the S3 bucket, and make the bucket publicly accessible.

Step 2: Launch the CloudFormation template

To create the SAML provider within AWS IAM, this solution uses a custom resource Lambda function, as CloudFormation does not currently offer the ability to create the configuration directly. In this case, I show you how to use the AWS API to create a SAML provider in each of your member accounts, pulling the federation metadata from an S3 bucket owned by the organization master account.

The actual CloudFormation template follows. A sample read-only role has been included, but I encourage you to replace this with IAM roles that make sense for your environment. Save this template to your local workstation, or to your code repository for tracking infrastructure changes (if you need a source code management system, we recommend AWS CodeCommit).

---
AWSTemplateFormatVersion: 2010-09-09
Description: Create SAML provider Parameters: FederationName: Type: String Description: Name of SAML provider being created in IAM FederationBucket: Type: String Description: Bucket containing federation metadata FederationFile: Type: String Description: Name of file containing the federation metadata Resources: FederatedReadOnlyRole: Type: AWS::IAM::Role Properties: RoleName: Federated-ReadOnly AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: sts:AssumeRoleWithSAML Principal: Federated: !Sub arn:aws:iam::${AWS::AccountId}:saml-provider/${FederationName} Condition: StringEquals: SAML:aud: https://signin.aws.amazon.com/saml Path: '/' ManagedPolicyArns: - arn:aws:iam::aws:policy/ReadOnlyAccess SAMLProviderCustomResourceLambdaExecutionRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: - lambda.amazonaws.com Action: - sts:AssumeRole Path: "/" Policies: - PolicyName: root PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - logs:CreateLogGroup - logs:CreateLogStream - logs:PutLogEvents Resource: 'arn:aws:logs:*:*:log-group:/aws/lambda/*-SAMLProviderCustomResourceLambda-*:*' - Effect: Allow Action: - iam:CreateSAMLProvider - iam:DeleteSAMLProvider Resource: !Sub arn:aws:iam::${AWS::AccountId}:saml-provider/${FederationName} - Effect: Allow Action: - iam:ListSAMLProviders Resource: '*' - Effect: Allow Action: - s3:GetObject Resource: !Sub 'arn:aws:s3:::${FederationBucket}/*' CustomResource: Type: Custom::CustomResource DependsOn: - SAMLProviderCustomResourceLambda - SAMLProviderCustomResourceLambdaExecutionRole Properties: ServiceToken: !GetAtt SAMLProviderCustomResourceLambda.Arn SAMLProviderCustomResourceLambda: Type: "AWS::Lambda::Function" Properties: Handler: index.lambda_handler Role: !GetAtt SAMLProviderCustomResourceLambdaExecutionRole.Arn Runtime: python3.7 Timeout: 300 Environment: Variables: FEDERATION_NAME: !Ref FederationName FEDERATION_BUCKET: !Ref FederationBucket FEDERATION_FILE: !Ref FederationFile Code: ZipFile: | import boto3, json, os, urllib.request, ssl, time, traceback BUCKET = os.getenv('FEDERATION_BUCKET') FILE = os.getenv('FEDERATION_FILE') NAME = os.getenv('FEDERATION_NAME') class SAMLProvider(object): def __init__(self): self.iam_client = boto3.client('iam') self.existing_providers = [] self._list_saml_providers() self.s3 = boto3.resource('s3') def get_federation_metadata(self): try: self.s3.Bucket(BUCKET).download_file(FILE, '/tmp/' + FILE) handle = open('/tmp/' + FILE) data = handle.read() handle.close() os.remove('/tmp/' + FILE) return data except: traceback.print_exc() raise def _list_saml_providers(self): providers = [] response = self.iam_client.list_saml_providers() for provider in response['SAMLProviderList']: self.existing_providers.append(provider['Arn']) def add_saml_provider(self, name): for arn in self.existing_providers: if arn.split('/')[1] == name: print(name + ' already exists as a provider') return False response = self.iam_client.create_saml_provider(SAMLMetadataDocument=self.get_federation_metadata(), Name=name) print('Create response: ' + str(response)) return True def delete_saml_provider(self, name): for arn in self.existing_providers: if arn.split('/')[1] == name: response = self.iam_client.delete_saml_provider(SAMLProviderArn=arn) print('Delete response: ' + str(response)) def send_response(event, context, response_status, response_data): response_body = json.dumps({ 'Status': response_status, 'Reason': 'See the details in CloudWatch Log Stream: ' + context.log_stream_name, 'PhysicalResourceId': context.log_stream_name, 'StackId': event['StackId'], 'RequestId': event['RequestId'], 'LogicalResourceId': event['LogicalResourceId'], 'Data': response_data }) print('ResponseURL: %s', event['ResponseURL']) print('ResponseBody: %s', response_body) try: opener = urllib.request.build_opener(urllib.request.HTTPHandler) request = urllib.request.Request(event['ResponseURL'], data=response_body.encode()) request.add_header('Content-Type', '') request.add_header('Content-Length', len(response_body)) request.get_method = lambda: 'PUT' response = opener.open(request) print("Status code: %s", response.getcode()) print("Status message: %s", response.msg) except: traceback.print_exc() def lambda_handler(event, context): print(event) print(context) saml = SAMLProvider() try: if event['RequestType'] == 'Create': saml.add_saml_provider(NAME) send_response(event, context, 'SUCCESS', {"Message": "Resource creation successful!"}) if event['RequestType'] == 'Update': saml.delete_saml_provider(NAME) time.sleep(10) saml.add_saml_provider(NAME) send_response(event, context, 'SUCCESS', {"Message": "Resource update successful!"}) if event['RequestType'] == 'Delete': saml.delete_saml_provider(NAME) send_response(event, context, 'SUCCESS', {"Message": "Resource deletion successful!"}) except: send_response(event, context, "FAILED", {"Message": "Exception during processing"}) traceback.print_exc()

As you review this template, note that a Python Lambda function is embedded in the template body itself. This is a useful way to package code along with your CloudFormation templates. The limit for the length of code inline within a CloudFormation template is fixed, as detailed in the AWS CloudFormation user guide. Code that exceeds this length must be saved to a separate location within an Amazon S3 bucket and referenced from your template. However, the preceding snippet is short enough to be included all in one CloudFormation template.

Step 3: Create the StackSet

With your SAML provider metadata securely uploaded to your Amazon S3 bucket, it’s time to create the StackSet.

1. First, navigate to the CloudFormation console and select StackSets, then Create StackSet.
    
   

   Figure 2: Creating a new StackSet

2. Select Template is ready, then Upload a template file. Select Choose file to choose the location of the CloudFormation template, then select Next.
    
   

   Figure 3: Specifying the template details

3. Enter a value for StackSet name. Then provide the following configuration parameters and select Next:
   1. FederationName: The name of the SAML provider. This is the name of the provider as you see it in IAM once provisioned, and it appears in the ARN of the SAML provider.
   2. FederationFile: The file name within S3.
   3. FederationBucket: The name of the S3 bucket.

    

   

   Figure 4: Specifying the StackSet parameters

4. In the Account numbers field, enter the list of accounts into which you wish to provision this stack. Select a Region from the drop-down menu, then select any concurrent deployment options that you need. For most customers, the concurrent and failure tolerance options generally remain unmodified.
   

   Important: When you enter your list of accounts, you must use the 12-digit account number for each destination, without spaces, and separated by commas.

   Because IAM is a global service, there is no need to deploy this to multiple regions. The template must be deployed once per AWS account, although it is managed by a CloudFormation Stack that exists in a single Region.
    

   

   Figure 5: Selecting your deployment options

5. Depending on your organization’s security posture, you may have chosen to use self-managed permissions. If that is the case, then you must specify an AWS IAM role that is permitted to execute StackSet deployments, as well as an execution role in the destination accounts. For more info, visit the StackSets’ Grant Self-Managed Permissions documentation page.
6. Review your selections, accept the IAM role creation acknowledgment, and click Submit to create your stacks. Once completed, ensure that the new identity provider is present in each account by visiting the AWS IAM console.

Summary

Creating a SAML provider across multiple AWS accounts enables enterprises to extend their existing authentication infrastructure into the cloud.

You can extend the solution provided here to deploy different federation metadata to AWS accounts based on specific criteria—for example, if your development and staging accounts have a separate identity provider. You can also add simple logic to the Lambda function that I’ve included in the CloudFormation template. Additionally, you might need to create any number of predefined roles within your AWS organization—using the StackSets approach enables a zero-touch means for creating these roles from a central location.

Organizations looking for even stronger controls over multiple accounts should implement this solution with AWS Organizations. Combined with federated access and centrally managed IAM roles, Organizations provides Service Control Policies and a common framework for deploying CloudFormation Stacks across multiple business units.

If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, contact AWS Support.

Want more AWS Security how-to content, news, and feature announcements? Follow us on Twitter.