A trivially simple stack to create an AWS IAM SAML provider via CloudFormation
This CloudFormation template creates a SAML identity provider in Amazon Web Services' (AWS) Identity and Access Management (IAM) configuration.
In order to use it, you'll need:
"
) character:
tr -d '\n' metadata.xml | sed -e 's/"/\"/g' > out.xml
out.xml
into the ParameterValue
field of the params.json
You can set the name of your identity provider via the SamlProviderName
parameter to the stack; this can be
configured in the params.json
. It defaults to MyProvider
The ProviderCreator
custom resource returns the ARN of the SAML provider as its physical resource ID.
You can simply Ref
the custom resource to use the SAML provider ARN.
For example:
...
TrustingIdp:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Federated: !Ref IdentityProvider
Action: sts:AssumeRoleWithSAML
Condition:
StringEquals:
"SAML:aud": "https://signin.aws.amazon.com/saml"
...
The stack can be updated, though the only changes you can make to the Identity Provider is to change the SAML Metadata document, in case you need to update the trust relationship.