AWS IAM (formerly AWS IAM S3) offers a suite of cloud-computing services that make up an on-demand computing platform. The most central and best-known of these are Amazon Elastic Compute Cloud (EC2) and Amazon Simple Storage Service (S3). AWS offers more than 70 services, including computing, storage, networking, database, analytics, application services, deployment, management, mobile, developer tools, and tools for the Internet of Things.

AWS IAM connectors are available for use with One Identity Safeguard for Privileged Passwords.

For more information about configuring AWS IAM connector with One Identity Manager, see Configuring AWS IAM connector to support entitlements for User and Group.

To configure the connector, following parameters are required:

• Connector Name

• Client Id of the cloud account

• Client Secret of the cloud account

• Region of the cloud account

• SCIM URL (Cloud application's REST API's base URL)

• Instance DateTime Offset (refer Configuring additional datetime offset in connectors for more details).

Supported objects and operations

Users

Table 41: Supported operations and objects for Users

Operation	VERB
Create	POST
Update	PUT
Delete	DELETE
Get all users	GET
Get (Id)	GET
Pagination	GET

Groups

Table 42: Supported operations and objects for Groups

Operation	VERB
Create	POST
Update	PUT
Delete	DELETE
Get all groups	GET
Get (Id)	GET

Profiles

Table 43: Supported operations for Profiles

Operation	VERB
Get All Profiles	GET
Get Profile	GET

Roles

Table 44: Supported operations for Roles

Operation	VERB
Get Role	GET
Get All Roles	GET

Mandatory fields

Users

• User Name
• Password - This is applicable only for the Create operation.

Groups

• Group Name

Mappings

The user and group mappings are listed in the tables below.

Table 45: User mapping

SCIM parameter	AWS IAM parameter
Id	UserName
UserName	UserName
Password	password
DisplayName	Arn
Active	(true)
Groups	(ListGroupsForUserResult)Group
Entitlements	(ListAttachedUserPoliciesResult)AttachedPolicies
Created	CreateDate
LastModified	PasswordLastUsed

 

Table 46: Group mapping

SCIM parameter	AWS IAM parameter
Id	GroupName
displayName	UserName
Entitlements	(ListAttachedGroupPoliciesResult)AttachedPolicies
Members	(GetGroupResult)Users
Created	CreateDate
LastModified	PasswordLastUsed

Table 47: Profile mapping

SCIM parameter	AWS IAM parameter
Id	Arn
displayName	PolicyName
Created	CreateDate
LastModified	UpdateDate

Table 48: Roles mapping

SCIM parameter	AWS IAM parameter
Id	RoleName
Name	RoleName
Entitlements	(ListAttachedGroupPoliciesResult)AttachedPolicies
description	Description
Created	CreateDate

Table 49: Mappings for v2.0

SCIM parameter	AWS IAM parameter
Id	Base64encoded(id)
targetId	id

Connector limitations

• Signature generation is embedded within a data process. Hence, the performance of the application is affected.

• The Last Modified date is not available. Hence, the field contains the value of the recently used Password.

• While performing Delete User or Delete Group operation, users or groups that are part of the deleted users or groups get detached from the below mentioned services. However, some services must be detached manually.

  • AccessKey
  • Roles
  • Groups

• The task of assigning entitlements to groups is available with the connector. For successful working, certain changes must be made in One Identity Manager.

• Roles has no assignment relations with Users and Groups object types. Entitlements is the only object type associated with Roles.

Connector versions and features

The following subsections describe the different connector version(s) and features available with them.

Features available exclusively in AWS IAM v.2.0

Following are the features that are available exclusively in AWS IAM v.2.0:

• All the endpoints return one new attribute “targetId”.
• The "id" in the SCIM response will be base64 encoded in all the endpoints.

AWS IAM connector for Safeguard for Privileged Passwords

• The service account must have the following minimum IAM permissions:

  • GetUser

  • GetGroup

  • ListAttachedUserPolicies

  • ListEntitiesForPolicy

  • ListGroups

  • ListGroupsForUser

  • ListUsers

  • ListUserPolicies

  • SimulatePrincipalPolicy

  • UpdateLoginProfile

• If manually adding an account to an AWS asset, the username to enter is the simple account username (not the ARN).

• Users must have a manually set password in AWS prior to management by Safeguard for Privileged Passwords. You cannot call "ChangePassword" on an account that has never had a password set.

• Safeguard for Privileged Password "Roles" are used for account discovery map to AWS Policies (not AWS "Roles").

• When a "Roles" filter is used in account discovery it only captures accounts for which a matching policy is directly assigned to the user (not policies it inherits through a group).