Configure AWS Login With Azure AD Enterprise App

The idea is to enable users to sign in to AWS using their Azure AD credentials. This can be achieved by configuring single sign-on (SSO) between Azure AD and AWS. The process involves creating an enterprise application in Azure AD and configuring the AWS application to use Azure AD as the identity provider. Once this is set up, users can log in to AWS using their Azure AD credentials and access the AWS resources that they have been authorized to use. The tutorial provided by Microsoft explains the steps involved in setting up this SSO configuration between Azure AD and AWS.

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/amazon-web-service-tutorial

1. Azure >> Enterprise APP >> <<Configure Azure AD SSO
1. Deploy Amazon Web Services Developer App
2. Single Sign On >>.SAML
1. Popup to save
1. Identifier: https://signin.aws.amazon.com/saml
2. Reply URL: https://signin.aws.amazon.com/saml
2. Save
3. SAML Signing Certificate
1. Download "Federation Metadata XML"
4. Add the AD user's to Application's User' and Group
2. AWS >> IAM >> Identity provider
1. Create
1. SAML
2. AZADAWS
3. Upload the Metadata XML
2. Verify Create
3. AWS>> IAM >> ROLE << This Role will Come in Azure Application
1. SAML 2.0 Federations
1. Choose :  Earlier Created Identity provider
2. Allow programmatic and AWS Management Console access
3. Choose required permissions
4. Create the role with Appropriate name
4. AWS >> IAM >> POLICIES <<  This policy will allow to fetch the roles from AWS accounts.
1. Choose JSON
1. { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": "*" } ] }
2. Name : AzureAD_SSOUserRole_Policy.
3. Create the Policy
5. AWS >> IAM >> USER
1. Name : AzureADRoleManager
2. Choose Programmatic access
3. Permission : Attach existing polices
1. Choose : AzureAD_SSOUserRole_Policy
4. Create User
5. Copy Access and Secret key
6. Azure Enterprise App >> Choose Amazon Web Services App which was deployed
1. Provisoing
1. Make it automatic
2. Give Aws Access and Secret key
3. Test and Save
4. Make the "Provisioning Status" to ON
5. Wait for a sync to complete
6. Once Sync is Completed got the user's and Groups
1. Choose the user, select Click EDIT
2. Choose the AWS Role