Federation
•
4 likes•2,581 views
This document discusses federated access to AWS resources using temporary security credentials. It describes how federation works by allowing users in other AWS accounts or identity stores to access resources in your AWS account through the use of sessions. Common use cases for federation include delegating access to other AWS accounts or teams and federating with corporate directories. The document then demonstrates how to request and use sessions to access AWS through the console and CLI using SAML and web identity federation.
Report
Share
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Federation
Similar to Federation (20)
More from Amazon Web Services
More from Amazon Web Services (20)
Recently uploaded
Recently uploaded (20)
Federation
- 1. Bring Your Own Identities – Federating Access to Your AWS Environment Zaher Dannawi Senior Product Manager Identity and Access Management
- 2. Agenda • What is delegation? • What are the scenarios? • How does it work? • Q&A
- 3. What is federation? • Delegation – Provide users in other AWS accounts access to resources in your AWS account • Federation – Provide users in other identity stores access to resources in your AWS account
- 4. Common Use Cases Delegate to other AWS accounts • To your team member • To another team • To third party software • To an AWS service • To an EC2 instance Federate with other identity stores • Users in your corporate directory – e.g. Active Directory, Google • Users authenticated by a web identity provider – e.g. Login With Amazon, Facebook
- 5. Sessions 101 • Allow temporary access to your AWS account • Are generated by the AWS Security Token Service (STS) • Include temporary security credentials that are used to make API calls to AWS services
- 6. Requesting a Session Session Access Key Id Secret Access Key Expiration Session Token Start by requesting a session from AWS STS
- 7. What’s in a Session? Use the keys to sign AWS service API requests Session Access Key Id Secret Access Key Expiration Session Token Use the token as an additional parameter for every API request Temporary Security Credentials
- 8. Multiple Ways to Get Sessions • Self-sessions (GetSessionToken) • Federated sessions (GetFederationToken) • Assumed-role sessions • AssumeRole • AssumeRoleWithSAML • AssumeRoleWithWebIdentity Session Access Key Id Secret Access Key Expiration Session Token
- 9. Sessions Expire Expiration varies based on token type [Min/Max/Default] • Self (Account) [15 min / 60 min / 60 min] • Self (IAM User) [15 min / 36 hrs / 12 hrs] • Federated [15 min / 36 hrs / 12 hrs] • Assumed-role [15 min / 60 min / 60 min] Use caching to improve your application performance Session Access Key Id Secret Access Key Expiration Session Token New in July 2016: Federated console duration now 12 hours
- 10. DEMO #1 - AWS Console Single Sign-on Active Directory Log into the console without a user name and password!
- 12. Wait… what just happened? 1. Logged into my Windows instance with AD credentials 2. Hit an intranet website 3. Chose the “role” I wanted to play in AWS 4. Auto-magically signed in to the console
- 13. AWS Console Federation Walkthrough (AssumeRole) Customer (IdP) AWS Cloud (Relying Party) AWS Management Console Browser interface Corporate directory Federation proxy 1Browse to URL 3 2 Redirect to Console 10 Generate URL9 4 List RolesRequest 8 Assume Role Response Temp Credentials • Access Key • Secret Key • Session Token 7 AssumeRole Request Create combo box 6 Federation proxy • Uses a set of IAM user credentials to make AssumeRoleRequest() • IAM user permissions only need to be able to call ListRoles & assume role • Proxy needs to securely store these credentials 5 List RolesResponse
- 14. Console Federation using SAML (AssumeRoleWithSAML) Enterprise (Identity Provider) AWS (Service Provider) AWS Sign-in Browser interface Corporate identity store Identity provider 1User browses to Identity provider 2 Receives AuthN response 5 Redirect client AWS Management Console 3 Post to Sign-In Passing AuthN Response 4
- 15. AWS API Federation Walkthrough (GetFederationToken) Customer (Identity Provider) AWS Cloud (Relying Party) AWS Resources User Application Active Directory Federation Proxy 4 Get Federation Token Request 3 2 S3 Bucket with Objects Amazon DynamoDB Amazon EC2 Request Session 1 Receive Session6 5 Get Federation Token Response • Access Key • Secret Key • Session Token APP Federation Proxy • Uses a set of IAM user credentials to make a GetFederationTokenRequest() • IAM user permissions need to be the union of all federated user permissions • Proxy needs to securely store these privileged credentials Call AWS APIs7
- 16. Partners
- 17. Web Identity Federation (AssumeRoleWithWebIdentity) AWS Cloud US-EAST-1 EU-WEST-1 AP-SOUTHEAST-1 AWS Services Amazon DynamoDB S3 Authenticate User 1 6 7 IAM EC2 Instances Token Verification 4 Web identity Provider 3 5 Check Policy Id Token 2 Mobile App Amazon Cognito: user sign-in and signup for mobile/web apps via social authentication, SAML, custom identities.
- 18. Summary • Proxy-based Federation – GetFederationToken and AssumeRole • SAML-based Federation – AssumeRoleWithSAML – ADFS – Shibboleth • Web Identity Federation - AssumeRoleWithWebIdentity – Login with Amazon, Facebook, Google – Amazon Cognito
- 19. DEMO #2 – Federated Access to AWS CLI Active Directory
- 21. What just happened? 1. Logged into my Windows desktop 2. Opened terminal 3. Utility obtained temporary security credentials 4. Accessed AWS services via CLI
- 22. What just happened? – Code Snippets # Use the assertion to get an AWS STS token using Assume Role with SAML conn = boto.sts.connect_to_region(region) token = conn.assume_role_with_saml(role_arn, principal_arn, assertion) What’s Happening: Call the standard AWS STS service to request AWS temporary security credentials # Initiate session handler session = requests.Session() # Programatically get the SAML assertion # Set up the NTLM authentication handler by using the provided credential session.auth = HttpNtlmAuth(username, password, session) # Opens the initial AD FS URL and follows all of the HTTP302 redirects response = session.get(idpentryurl, verify=sslverification) # Debug the response if needed #print (response.text) What’s Happening: Assemble the authentication information (username, password) and formulate the https request to the IdP # Parse the returned assertion and extract the authorized roles awsroles = [] root = ET.fromstring(base64.b64decode(assertion)) for saml2attribute in root.iter('{urn:oasis:names:tc:SAML:2.0:assertion}Attribute'): if (saml2attribute.get('Name') == 'https://aws.amazon.com/SAML/Attributes/Role'): for saml2attributevalue in saml2attribute.iter('{urn:oasis:names:tc:SAML:2.0:assertion}AttributeValue'): awsroles.append(saml2attributevalue.text) What’s Happening: Iterate through the IdP response tags until it finds one named SAMLResponse.
- 23. Q&A
- 24. Links • Twitter @AWSIdentity • AWS Security Blog http://bit.ly/1n1z1QL • IAM Details Page http://amzn.to/1lPyQs9 • IAM Forums http://bit.ly/1p2Ip6M • API federation sample http://amzn.to/11AFKtS • Console federation sample http://amzn.to/1vlBZ6N
- 25. aws.amazon.com/activate Everything and Anything Startups Need to Get Started on AWS