To federate AWS IAM Identity Center (AWS SSO) with Okta or Azure AD, follow this setup:
1. SAML 2.0 Federation 1. In AWS IAM Identity Center Console, go to Settings → Identity source → Change identity source and select External identity provider. 2. Download the AWS SAML Metadata file and copy the ACS URL. 3. In Okta or Azure AD, create a new Enterprise Application for AWS IAM Identity Center, upload the AWS metadata XML, and map `user.email` as `Subject NameID`.
2. Automatic SCIM 2.0 Provisioning Enable automatic provisioning in AWS IAM Identity Center to generate a SCIM endpoint and Access Token. Enter these into Okta so users and groups sync automatically.
You can verify SCIM connectivity with curl:
```bash
curl -X GET "https://scim.us-east-1.amazonaws.com/v2/Users" \
-H "Authorization: Bearer YOUR_SCIM_ACCESS_TOKEN" \
-H "Accept: application/scim+json"
```
3. Permission Set Mapping In IAM Identity Center, map Okta groups to AWS account permission sets: - `DevOps-Lead` → Production Account → `AdministratorAccess` - `Backend-Engineers` → Staging Account → `PowerUserAccess`
Developers can then log in securely via CLI:
```bash
aws configure sso
aws sso login --profile staging-backend
```
Gotcha to watch for: Set CLI session limits to 4-8 hours so developers don't have to re-authenticate constantly, while preventing unexpiring access tokens.