Prerequisites and considerations
Before you set up trusted identity propagation, review the following prerequisites and considerations.
Topics
Prerequisites
To use trusted identity propagation, ensure your environment meets the following prerequisites:
-
Enable and provision IAM Identity Center
-
You can use trusted identity propagation with your AWS services deployed in the same Region or in different Regions. Choose the deployment that fits your architecture:
-
Same-Region – Enable IAM Identity Center in the same AWS Region as the AWS services your users access.
-
Cross-Region – Create a multi-Region IAM Identity Center instance configured with a multi-Region customer managed KMS key. Trusted identity propagation then works across the additional AWS Regions where you replicated your instance, with no additional configuration. For more information, see Implementing customer managed KMS keys in AWS IAM Identity Center and Using IAM Identity Center across multiple AWS Regions.
-
Organization instance – We recommend you use an organization instance of IAM Identity Center that you enable in the management account of AWS Organizations. You can delegate administration of an organization instance of IAM Identity Center to a member account. If you choose an account instance of IAM Identity Center, all AWS services that you want users to access with trusted identity propagation must reside in the same AWS account where you enable IAM Identity Center. For more information, see Account instances of IAM Identity Center.
-
-
Connect your existing identity provider to IAM Identity Center and provision your users and groups into IAM Identity Center. For more information, see IAM Identity Center identity source tutorials.
-
-
Connect the AWS managed applications and services in your trusted identity propagation use case to IAM Identity Center. To use trusted identity propagation, AWS managed applications must be connected to IAM Identity Center.
Considerations
Keep in mind the following considerations when configuring and using trusted identity propagation:
-
Organization vs account instance of IAM Identity Center
-
An organization instance of IAM Identity Center will give you the most control and flexibility to grow your use cases to multiple AWS accounts, users, and AWS services. If you are unable to use an organization instance, your use case may be supported with account instances of IAM Identity Center. To learn more about which AWS services in your use case support account instances of IAM Identity Center, see AWS managed applications that you can use with IAM Identity Center.
-
-
Multi-account permissions (permission sets) not required
-
Trusted identity propagation doesn't require you to set up multi-account permissions (permission sets). You can enable IAM Identity Center and use it for trusted identity propagation only.
-
Considerations for cross-Region trusted identity propagation
Keep in mind the following considerations when using cross-Region trusted identity propagation.
-
Eventual consistency
-
IAM Identity Center replicates identity metadata to additional Regions asynchronously, with eventual consistency.
-
-
Tokens and re-authentication
-
After you enable multi-Region replication for additional Regions, those Regions do not accept tokens issued before you enabled replication. Your users must re-authenticate once so that newly issued tokens work across all enabled Regions.
-
-
Blocking cross-Region calls
-
If you do not want AWS services to make cross-Region calls, you can block them by using a service control policy (SCP). You can build this policy using the
aws:RequestedRegioncondition key to allow only the Regions you use and deny requests to all others. For more information about an example policy that uses this condition key, see AWS: Denies access to AWS based on the requested Region.
-
Considerations for customer managed applications
Your workforce can benefit from trusted identity propagation even if your users interact with client-facing applications that are not managed by AWS, for example Tableau or your custom-developed applications. The users of these applications may not be provisioned in IAM Identity Center. To enable the smooth recognition and authorization of user access to AWS resources, IAM Identity Center enables you to configure a trusted relationship between the identity provider authenticating your users and IAM Identity Center. For more information, see Using applications with a trusted token issuer.
In addition, configuring trusted identity propagation for your application will require:
-
Your application must use OAuth 2.0 framework for authentication. Trusted identity propagation does not support SAML 2.0 integrations.
-
Your application must be recognized by IAM Identity Center. Follow the guidance specific to your use case.