├── CODE_OF_CONDUCT.md ├── CONTRIBUTING.md ├── LICENSE ├── README.md ├── img ├── azuread-automation-setup.png ├── azuread-automation-workflow.drawio └── azuread-automation-workflow.png ├── manifest.yaml └── templates ├── azuread-fed-management-account.yaml └── azuread-fed-member-account.yaml /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | ## Code of Conduct 2 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). 3 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact 4 | opensource-codeofconduct@amazon.com with any additional questions or comments. 5 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contributing Guidelines 2 | 3 | Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional 4 | documentation, we greatly value feedback and contributions from our community. 5 | 6 | Please read through this document before submitting any issues or pull requests to ensure we have all the necessary 7 | information to effectively respond to your bug report or contribution. 8 | 9 | 10 | ## Reporting Bugs/Feature Requests 11 | 12 | We welcome you to use the GitHub issue tracker to report bugs or suggest features. 13 | 14 | When filing an issue, please check existing open, or recently closed, issues to make sure somebody else hasn't already 15 | reported the issue. Please try to include as much information as you can. Details like these are incredibly useful: 16 | 17 | * A reproducible test case or series of steps 18 | * The version of our code being used 19 | * Any modifications you've made relevant to the bug 20 | * Anything unusual about your environment or deployment 21 | 22 | 23 | ## Contributing via Pull Requests 24 | Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that: 25 | 26 | 1. You are working against the latest source on the *main* branch. 27 | 2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already. 28 | 3. You open an issue to discuss any significant work - we would hate for your time to be wasted. 29 | 30 | To send us a pull request, please: 31 | 32 | 1. Fork the repository. 33 | 2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change. 34 | 3. Ensure local tests pass. 35 | 4. Commit to your fork using clear commit messages. 36 | 5. Send us a pull request, answering any default questions in the pull request interface. 37 | 6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation. 38 | 39 | GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and 40 | [creating a pull request](https://help.github.com/articles/creating-a-pull-request/). 41 | 42 | 43 | ## Finding contributions to work on 44 | Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start. 45 | 46 | 47 | ## Code of Conduct 48 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). 49 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact 50 | opensource-codeofconduct@amazon.com with any additional questions or comments. 51 | 52 | 53 | ## Security issue notifications 54 | If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue. 55 | 56 | 57 | ## Licensing 58 | 59 | See the [LICENSE](LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution. 60 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | 3 | Permission is hereby granted, free of charge, to any person obtaining a copy of 4 | this software and associated documentation files (the "Software"), to deal in 5 | the Software without restriction, including without limitation the rights to 6 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of 7 | the Software, and to permit persons to whom the Software is furnished to do so. 8 | 9 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 10 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS 11 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 12 | COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 13 | IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 14 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 15 | 16 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ## AWS Control Tower Customizations to automate SAML 2.0 Federation with Azure AD 2 | 3 | Use these templates for AWS Control Tower Customers leveraging the Customizations for AWS Control Tower solution to enable SAML 2.0 federation from Azure AD to AWS. The solution uses automation to accelerate the onboarding of new member accounts by allowing AD admins the ability to securely configure user provisioning directly. 4 | 5 | A diagram of the workflow is included below. 6 | ![workflow diagram](img/azuread-automation-workflow.png) 7 | 8 | ## Prerequisites 9 | * AWS Control Tower 10 | * [Customizations for AWS Control Tower](https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/) 11 | 12 | ## Usage 13 | Deploy the following templates using the Customizations for AWS Control Tower. See the sample manifest.yaml file for deployment snippets. 14 | 15 | **azuread-fed-management-account.yaml** - Must be deployed to the management account 16 | **azuread-fed-member-account.yaml** - Must be deployed to all member accounts requiring Azure AD federation 17 | 18 | ### Configure federation to the management account 19 | 1) Log in to the management account and navigate to the AWS Secrets Manager Console. 20 | 2) Navigate to `AzureADFederation/CFNUserSecretAccessKey` secret and retrieve the stored secrets. 21 | 3) In the Azure AD EA for the management account: 22 | 1) Enable [user provisioning](https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/amazon-web-service-tutorial#how-to-configure-role-provisioning-in-amazon-web-services-aws) using the secret values AccessKey and SecretKey. 23 | 2) Map the synced `AzureAdFederationAdminRole` to the appropriate group in AD. 24 | 25 | ### Configure federation to the member accounts 26 | 1) Federate into the management account using the AzureAdFederationAdminRole. 27 | 2) For each member account, follow these steps: 28 | 1) Switch role to the member account using the account Id and the `AzureAdFederationAssumeRole`. 29 | 2) Access the AWS Secrets Manager console. 30 | 3) Choose the `AzureADFederation/CFNUserSecretAccessKey` secret and retrieve the stored secrets. 31 | 4) In the Azure AD EA for the management account, enable user provisioning using the secret values AccessKey and SecretKey. 32 | 33 | ## Security 34 | 35 | See [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information. 36 | 37 | ## License 38 | 39 | This library is licensed under the MIT-0 License. See the LICENSE file. 40 | 41 | -------------------------------------------------------------------------------- /img/azuread-automation-setup.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws-samples/aws-control-tower-customizations-to-automate-saml-20-federation-with-azure-ad/ffc318a6e733ffc13609b821162f049920a3daad/img/azuread-automation-setup.png -------------------------------------------------------------------------------- /img/azuread-automation-workflow.drawio: -------------------------------------------------------------------------------- 1 | 7V1bd5u4Fv41XmvmARYSVz/aTpyeM2lPJkk7nScvArJDC8YFnNj99UcCxEUSvsQQO4ndrtYIEEL72/ctuaeOgtVVZC8eP4cu8ntQcVc99aIHIQSKhv8jLeusBZh9NWuZRZ6bt5UNd95vlDcqeevSc1FcuzAJQz/xFvVGJ5zPkZPU2uwoCp/rl01Dv/7UhT1DXMOdY/t86z+emzxmrZaulO2fkDd7pE8GSn4msOnFeUP8aLvhc6VJveypoygMk+xbsBohn8wenRdHncJkaMzGg9l0+Esb3d6GrpR1Nt7nluIVIjRPXty16c4nP7zvzufn6/E/i4df62T8t9TPun6y/WU+X4E9x1MSkCdhAjhOuCTf0vdP1nRSF6E3T1LC6EP8Fz94pPR0fGZEjmSoMw3ssVlvAPwR6aPewB6b9QbAdg+Y5wN2gJUG7qjWvcI8X6kMEP9Vh+Ey8b05GhUQVnDjLLJdD0/jKPTDCLfNwzmeveFjEvj4COCvz49egu4WtkNm9RnzH26bhvMkZyIA6XE+8aRXDMIF+R6sZoRhZfs51uRZFC4X6SP/g9lIeHaCv04cP1y6pJMkCn8iOrAeVPGfMUHNcOr5PjPgJxQlHuange/NSN9JSB5l50c+miakR/wW3nx2nR5dqEo+ctEjXDt+RG7+OjsiO+cAMhS0qvB1jvQrFAYoidb4EnqW8ncutiSVcvFzKQQMKqMeKwJAo/xv54JnVnReMhf+kvOXmNdufzjf/9Yvb6RvT9KVqgLLe8JD4HiN4yvB9HO00gfGyDKqEwkaqcSih6FJ0ZVvPyB/aDs/CVbmbuWSafrhCd4Z4UyGcFhUc4TTTQHhoKEfTri7we3q0r74Op5+u3tIgk+XX7R/c7m6kXC4F6zQUIVBKa+JmLwiA7qaRwlAU9brU2nxLAD6xVXVuQRaC0zgfoLP2vrpe3+4UszB1UP/+X+RYC4DFDygSMpVjfT7rGw+irJ5k5qFkU9ANWRd5VWLIZBQKuzLpnk4YwktOW0bY9lnxjoz1gkzVuF4Uc4yzD04y+qOs3SLY63B72WEBu4YuSiyEy+cD9zAm9+GmMAskwlR1TTRDWirmoX48pEJVDDmEJBfXCMWRcI1MfBuwtgjg8XnHsIkCYOtUHHwWFBUx/s2bNvxInvRqbci4ximYgZFl08okzagiQEiMn87GaNdYVC3TBkajAGq8maTpskqFJigLVigYgjyfnoPGn7OxvMa4oxfSxKRGDrZvA3wyWj28Ad+CSLx8L+Vb3+Sr2Q6FUJFKU7JSu4AymLFnMseQE56CcaHU5zGc4u1S4YYcjqVL/TkQ0FHiRkQ1KxiIFDrl991Miz6FvjbjPx/Hy1jgh5yd8l2+OAmCp88fEznA89vNiXZfbT5IfoAk/TBMDHw/TQ8SO4exPEyQJkEVpKQMGHKVvZi0SviWHF+zrADIuXmD/GCgUh9Hhuw1Di97Fvn4rORTmQShR0JZ76pF6/SwLyY0nETrwerZLDnrnBuX3mQTx56JoR/JGOKkRMhMunevGirhjyPP9wi5lpg0GMpjtsy6BwG1/clDfZg4zdhogWe6/qiAGxxgjHoX8VGW6Ao8OIYDzHezVTzmdeKMnOpOxOOBnWp/QYMPoAIYWHm1ew3qyvn/Bz73cUDhHXSQUUcW6GX1UhH4zKH0G48WU2D6PL3NPk1dqz7p6vk+it9jWqw150hOrNhlDyGs3Bu+5dl6zCdyYLDy2uuQ0KalGg/UJKscx61l9gq4Ri4Qolx+mHpvh8d4nAZOWgTSHNMJnY0Q8mmC3OGIvOwka4R8rFV8FTPxLZOINjoG+X2lVNMZKkzVCX98GrkLgkjYhT8ROu4Ud8KAJGK7zoROS+6UZJHCCtW+6Hg1Xpk7mIDIHgMbAIxx4tF3j1/eK+a2hbmFRRZMfsmI2Kzw53Jnfd+Q96y0rUmW6AeAmJ4OpxOY5RwgClGeYCA5kGU2bYXA8ybQWrbfo1LL7M0MgaOg2LiWPyVAuZNmBYnGf3xw/lsgq8MJthGX0Zesp5gU93Ft3m2v5ue6kwxWXXFpIkVk6rKfUFUSG1BM4lBy8f8haC9SgPLrUKTiCBdM7FRXp678CLcUYawOdF5O2O3SsOTA7A4VIkydZpF6on8FsXsvRS9GMjYE57YqaCYVJzNo2JaVft1YwsCIaYtAaA7M5P1JkBXQ37j0fgLgfVd6spn8hcL3zPAXx/gWTSFgjo6LqJ1o17voClCRGsC76GNcgeh3aUe5DyAlzkPNSehyXBEc3dAyivJMJ5SBYtbxp7/ssKU7c4Frf3c6lzAtp2L9Fb8rva6ckFuYTcao4CxcdUyzz9+8S34SzaOl9quQozxVsAh/s9NFGIGD4j14PDWrk2t3fflHtHwTBvuEY31rGv9HOgbMcpaU2T4aq4R4PDV4Bqd9e/ZwKyIQ9OU+/Vc+inYmLQw+OOm0qtpU8/GIB9ce3FCcnbxOWOyM9e+n4yJarGeoDC60WHORFgpzGdIXsF0rsKAM6U5naIoZpOZsauxLHz1nW1lcBK2sqTWw7YwH1dbVq9wjviM2t16TiRpLsiOY4NWscODYhPOW7E9TbOTyLwi9+siwlRlWpLWqgG6iRtY+xM3DS44Om816CrE39G2EyokRnspyvByDEUqgAw1+xcbaIQGEzc1Y0MyJ5za6UrGSzqzFkQTBEaES0H0FkIjwuVQOwavzxmXj5hxgbS8thBktDr8dfItQsQ2RqfP6ZazN7wF0JoCZcOqYxqahszXJnXlDQshbTRB+pxwOUmIn1bCRSOrJZTiU/cCsMjmwd1V8kUIbn7dzjnSc470fOBIj8buigBNINBAHUZ6hHwKdKG7vk+o58cyWNDr7ch5WfAnTuwooUnRogQXt+VpUYUNCGHyROvv5AxZaJof/5tfmR5crGpH695L1lBuTa6C3JfaHjDKvb6WA0ZcwAAyazmL3TdoF9lI87s25lQVGWh9Q9cwePuqojImFCAmlGVBVYd9DQBTZxaBZlPHPecFoQkxcnn7SbQM4ej5UO2C/BECbyNHHh6UUmQFWlqNaFpOo4PLRfvCblsNSAmzxbwfeFjBMdYRUjpUBRt3doLeZmK9YyCRwmOVLsV+KXSKnVC41eLd5c9BU6DLlUonSypDCFIKCDqYjm2x4QiouvH+QlsxmcMje0eGwnn8gA9iaQJ3XzO6281ANZvgKF7F+Sb8gZPE4AlsZ8BDMI05CWL/r7yhgfbhqzCqGxps2k7kvKvBBwNGNWiTRVxJrutzHvAjY4xEkOmVa9vPkZ2PF9nRsKQ3++Wnnu4lO4+9bkmP0HEyhB7M+66GF7pFuQ1WjddsypF3H66pl41Ao4TLlkgK35fF7J9UrOreEvtpyzvn7dtzOfye5fA0qvVWyuGhKStd+PObePdcDn962dFTLgAoylKOk/0X8rl1DH38whJbtPKSLNWig/ywyLTg72WihRysKwc3KPLwdBFcHph72bVWd5PYOLFSXQnmIVVhra7gdlJjqpcp/7ocLvJLexsN3K7fbCKnY6OB31/x9KuJN7H0KVcTSwwEdYBdlw60t3gjFOUgmXea2/ls8h22CiajE8HEszhUZUuxdAXzer8PmZVhmgpkHZbuq8kEHncVJLqp79Vvx2IF8LXr572JmljyvDlR0wRBAYoYMgv3chfu5y7a0124rzu/t3vtsnS3dcET2EZRm8k3Av4yukE73yhqE+1Gz94NBHcD5u4U0ufpbHU6D/Z9VU2z4H6+b0Nq+736vrgJv6c/ScLndBj7WRO7+7FGnzXVRT/QIyjzbWMhkTCXSLd9qYjHUfoTCVBJ82hpHiWhSzJ2/BU15cmLvbra2e+X1SBfGuZM51K6Esx2pSlypTgv9JDXNobMK+Rn3mu1R4KCBdbuSAj7zZjZGfcWh3vasK28vaudDAzeLGARZhP8S6QQ4Yyxt4gx9egYO8oGVkVddXGQhvrkosa6oayaKc4uUnqOb8ex5/TYrN7uVbIbCVx1xb/99WhcqXB5514aX5Xr5P72xz1VKVvLsylHd+2LA2A0CbN9HW7D0GRDrySeGQAbfVm1uNNb3O+9N+sCzNZv+LkGg/3DtiAQk4uv7ASkzmSUVvESsyOtQoTKH0T4Yfp7QfYTBNgY+fMEHPW98d7mNllApT8t3GpmUDJNGTIgBEzQp7taX1ov9xZWsuwgHzMVTn82mdWvnMQ9QGxuNKG3yk1aYt213DQ4sckGrlsSaCaXD6nLs+036MrG63XW0qhf3428pBnQY3MHk3F8JVY5llEBXynALzAqctB2sBpLjC8+2g5LfRxThXyXLrU5JZ28Oc+3kZfaWKEFgdaO8oVZhLCme1VZZYy+VtTv9SJc3ARX931n8vu/8Zcf94b0TTpcvhwqTQ5wOiqLSQ9cS3qY1qVOyNbEYTdrSfdVlZrKmf4bVBlfScYCltuOYFdPqFjjWv7wUGeFj5sUQnMYtPvgT3H5Owv+LOOGmHpLgR8AuJX5ll7I0lp5mGiPrrJ1jwAQPoxCkl4uMUhe+HPoEnV3+X8=7V1rc9o6E/41zLz9ACNLli8fgYScM+U0aWhPk/dLxoBC3Bqb2CYJ+fVH8g3rwi3YkFvaaZEsZFn77KPd1VppoO706Sx0Znf/BGPiNSAYPzXQSQNCqAGd/sdqFmmNZtoorZmE7jirW1YM3GeSVYKsdu6OScQ1jIPAi90ZXzkKfJ+MYq7OCcPgkW92G3j8XWfOhEgVg5HjybW/3HF8l9ZaGCzr/yLu5C6/swayK1Mnb5xVRHfOOHgsVaHTBuqGQRCnn6ZPXeKx2cvnhYyG36/uI5t8JadX303duP/RbKad9Xb5SvEIIfHjF3f91Ln69dz3gnPnfng5hMb5dDHPvgIeHG+ezVf2rPEin0DaC5UVLXToBMxY5cgL5rTTzuOdG5PBzBmxykeKH1p3F089WtLoxy1HnT3dAwlj8lSSWfYUZySYkjhc0CbZ1aZmZcPOMImy4uNSvppttnBae1eWrp41dTJUTYrelzNHP2STt4OMoDSRUzIdkrDpjEbB3I+bz9LEzgLXj5Nx4A79S0fWBQ1Mr3RZqQWxUCGWTb5Ck0usD75CLJt8hSZ2rwn318QBliqkEtc9EO4PSgOkf1EnmMee65NuwQOAVk5CZ+xS/HQDLwhpnR/4hEeZCoS3gR9nTKTBvJxNPCgBefo0YazXch4jvTUJg/ksueXflIuUV2/ox5sc/VEcBn9IPrAGRPRPjyGmw6DsUgZqe+6EdRQHrF8nK3nkNmZfp0N2/Uk/KZ0gkA1T1d/Yie7IOBt7XVql8zqlmVQ4SNIrwwCyViFot0yzJsVCmxTL+VSsT8V6xYpl8ooFgbaDYln1KZYuK5bjU2toyp6f3i9Vr0/l+ijKdet6njDgN6lvGuYVrmnK5iE2FdoGQV3GId5sZStmXxIVbhtdyyjPo7ZSSCJ4BJEUXXnOkHgdZ/SHQcUfl5rcJj+yvGuTm2HzckOIEiVY/kBJjBAbLWApzHxYlyQNSZLt53lI2uMeGZPQid3Ab4+nrn8Z0JkXZazkilW6soJDyjihzbumhrSeBJasMadvOU76TOIXQeSywdJrwyCOg+lGbR/RsZCQZ7FNjOVEs/RBb90nNo5OsniQ8PSBpGuItorWQjZ/W6GzLjgiuk5byF7+8OCEJg9OzZLQqestBBU0g2vCpqlgGcPLKNrnoGjcz1nUojNKJ7RNL4aT4f+o1rAFrpEwYf7pC/vI5hkw8TajRN7sGxqYPQnX0huwi25MgTMqLtNJp5Z6CiV2OeGS/OKwEHBTGBDUrWIgULeXnzEbVv4U9NOE/f8jnEcMVuzbS32khYsweHBpOZ8POr3plKTfy6uH4QeYpA+GibbnJSFE9u12FM2nJKVmEAdMBxOtcmazpcEbZdcMZ8rozx9GMwEi/DyuwNLK6RWfOuPVlXJik6jsSDnzq3pxSxXCg4Gaq+QFsiSGYg5dxbymj77fdL8vNO8Awzdhe0zd8dhTeRrFBcH4PIjxMSPh1I0iOsRoOxvEEx4rTFf7+kxlS7BNTD4ebrZMo3RVNk0gbEFDYZpYNZkmmqawTT49IEGsthAp0tUh2Ny54SSXO7TVi07e2WiPRiRi6+RXsojeCNO8Si/HC/zJDW05vYnIaB668eJmFNJ10o9dxzuu+1O40IvcmVGCkfrotsLHQbWhUd4OSO2Lk/acyjexL35GJDxLwmKVQpNe62HdpGv08tqJG9KOUoT5QchmZUvslmX46gCsdslJFMzDEUnjjB1aVEUc3QS9FMiOP75xEqK4KcWVj4ppKEQGkW63TAWmFRElVNvKKIfhM0CXPdhet/eNwXpAKD/EKf9S8v0E+OEBHiUiyEEdHhfRGGGepRFWsbSusBhqy4TQ5BjpB/PSyjEH16GQbvfdKGYOb/Tprn1Adw0BYd3BumrdObhTZkqwI+MJyYXC2D6YBL7jnS5rO8mkFp7Xsk0/YCydVP4mcbzIRO1Qq2w1DjTRk5OWEADMXq+3s2xSIl/XLgvnx044IWs7zAiWzcxaWYfEo4v1Q7mRWmbJV9th6CxKDbJd9WXPF6xiCaFm3mPuG5pAkH/a4xINxdD2AIglMflg4TMyzbhMgZ6EMniJSyv3SvagS6777AwLTuBzDU4U6NkWFvneiKizRd5pdtdGObVTmXwIWqbJh1ty0O2GAEnEoGXzi7lhtYStouD2NiKxpPhViNpWm6G0qn0iCXqjCVeS/pbWnHJRElYwADqnPahaBthQ03+pz8FkcDNODNeATYq09NTF800N8BLM81TLppgyLxXXZoypEnx3NsYySywzw1baYOsMsNXWV2I3rdnJ+6fwHtvpDs26Hfdq9vcO/rxvQSZlqzb1Q6NCOmFyE/avJBz2OEnrT9P3A5q+ugZbls5bv8BS+aiHtn5XLHirNirfBEhfZZD7+Kk8GME1qTwQ4015ZjVm8oz7V2eX9yb4OdDx+aV99xfu9hVv5WTYbC7B2VwGvA+Bzk5XQ9h4f+iMYgrJI8PTtFqgnErGwRMrbEhFgFo3KskU/3Yfwn7nbPD778fzq2EzDL+a/zblzdv2rwGtOA8njk8dtjhZf+gtpOyEdp5EDv4l/tj1J40kGSvdPqw6do103YKNnWLXK1D9XmPXASewGhGt8QGvpnrzEC9reWeoqK7eH5JTsZX7h9Wj83Nn5T1tHW5hNBx0GxHLoboudaFp78wp65F4dNco52vs+S6xOjdek7TmAPFk+hjh4orBsYWL8nUGz6Rw8sSVFuXSBQldKgEG+0KjXxBfzKe/HHdWLqUZTDaHnTMb9dhhZ4s3RppYwMVu7fkwtSrI3dLKeWt5ADrvzRLCZOl0Z71UHxQ1oKRUmO1C0kXg1p2k0dEsmziNi7+ZeLixigB3joeDFrDAngHwSsPbp9P271/I+P+P89PhuTe7uWnfj3O1Oywz7cEd6yIWm7lDr4U7JHVFptYCuKSvfPDbNpRZqBt0V7oLNvhuoYEl8zCdkip4QIkeOUVHZzRwSbt1yQNT/z+qRMgDqL8MsXXwr0Lboanz8sg7f73KD5SSqdsseXLj1CoxcVa8Ll1a2iSskJskVTMG3pIx6jE2ZMJI3s7mdk7FV263ZQWEdKGnFe/jbaCIXQ0iZPAGjrbBIMIYr2u/9769EvByvAYxvkrD2UyMqoj262GrPPpZAVshLFiQ1WzVNzXNkrHM91LfXj2235g1s5cnZByGm5pGC4oC1Q7sbshhf/ilUbzKyjSX3jl4VQq8FqCfGrwe+yVBnwRTx2V75UkugyTbGjZ0iubvbENnHlWclF2E1nbJAwItXN7SMQSgKU6sQ5YqMQhJOWDVnf8j74CXQobdkKSU0y6fA7Rn2NBE1xc/B4t+0/SN86F9dmEEt7l39cLVDLw0ajhus8Ml2R0eknetaE3P9XZc7fI53Jxvuq0pnr/gdOTAHxQOY0FwvZ27of2GwB8UtuSRDlt2ObAg6MC2XoLUr22L6lRd6EAJbsV205gBNz1j4DjxwhIX6ifsjxLv63S1kkBC/t7gS1fyhfIL9Znd+v7p8r/n01ne3glHL6OuiEI2zsmreFGa1mX0BXh6G3lOFCXJfjzDpct+fiSuuCbvEI1QcaDS6gEyBa5LN6jb4sc6Tw5N8Y2oFdQgdaQLr8o2Nbs2x+EefQ/7rn2NtOa0PwXXX/H1hcLf176Ul/D0wMzG6jP9Xo/roFeZqA+NPCVmT6jUwTFKft0/VHkwiuHe29mDKtYlwG22lg7EFaZwOq4upv5VFF60hPtkb4mtYh6xeT6s7awuA2lc3pkY16dGmCrFoXpSU6qCTGoDlqo3YIqXUdsr2XJZp8mV8JgNhBTqffdc8gEJqYa2tLFWH9MZezNdDV7fKuu4Kq7b0zWEtZDdrhylIf71t/wtpy1dPfHsfvGokG19O83gh6GLRlfNnp182uJFGExCZ8qSCEfKVNg1h+a8ftcvf6u/AtcPG6Zgeu8Z1C1OjAXFcbD1Mxg8MoOtcuyOQ2JwWxI7UHKKZqGWBSwMoAlsG9p8BBaDF0aUxGwUqaOaWUc+/mgQByF5u7QCq6MVzcwPVaiWVg62LSTv/3WTU9s/d4UaFe0K7Uh7OxzxYYGWqZdC1qLBrh12x8d+sBaz+ejZ6H/7fvnrGvrOGKviRBKm+BVqw294yo7+pyUoQYaCSQMmsomMyV7yI4MPAL1r23WKSdcFhoAA5NNdfhdV+dsBapIKlKSCPphUkGmLe/HFL+o6llTkQ6zkfcr3LRUMeF1B+RbfsUQie1yyCf6+RSK5TTmBH0sk8ltH+IOJhDo0QoJSbVpCi8tfNpnanMvf2YlO/wM=7VzbcqM4EP0aP+yDKcSdR1/i2ZnNbKWSmtnLiwsbGbMDyCVwYvL1K4EwSCKxk+DbjD2pidVAI1rndEvdIj19FG8+YW+1/Ip8GPU01d/09HFP04DtWuQXleSVxFFLSYBDn8lqwUP4DJmwOm0d+jDlTswQirJwxQvnKEngPONkHsboiT9tgSL+risvgJLgYe5FsvSv0M+WpdQx1Vr+OwyDZXVnoLIjsVedzATp0vPRU0Ok3/T0EUYoK7/FmxGMqPUqu3z+PMLa7Hv+8HUwg+lm8X357d9+qWzylksMo+zAoxet2VN9S7Iwi6BPpLdeDnH1MBgm2ftv/mXtZY93917/SxAvA9ubTfvskua9YxjPIO578zlaJ1n/mVknyyuTr1CYZMWwmUPyQzSM1J5JjoxoS9FMQSC2bV4A5BbVwQvEts0LgKgeCPcHYgcbAqnFqVeF+6uNDpIffYjWWRQmcLQFuEqEAfb8kAzWCEUIE1mCEmK94TKLI9IC5OvTMszgw8qbU6s+EXYS2QIlGaMY0Ko2MzzVSiC6ot/jTUDprHhPqaEEGK1XxS0/E5K1Hp2Sr9N5hNY+VZJh9ANWHetpOvk3oYgZPkKchYRagygMqKIMUb0ea0VwkdHLSZfDJLgtWmNdZd1s0+d76RL6rO97QnhLBtIXuGlwnGH6E0QxzHBOTqmOGgzDzIWZlWt6qv2BUZF82fAFmuEots1cEXNDwVZ9TSTyhXHpDaS23V3E2lyJdSXWJRFLOwtiGaZELIlIRA2Zf8DGwFZj1AaOBnYOZss+sHljWrItgWsrpmzN7TB0b0p7l4/yrj7q6qPO2kcJtNIMoGj6ObgpR+aWl5DVSExNoFkRNeeMTOytgH5jhLvS7Veh2yKMIqHDl8lAU+UZ2G+ZJWh6C/2Aeai4ZuoS9wbPawwH4wn0IfaykIydNhlN/vyWQvwA5xhmg/kcpukfMJco2Iq5l2wuYpEcm5iGbbiNY+MQE0VhgZ8EYWokDg7kmpENdDBpA9Ci+IijW0Hn1pvB6A6lIVM/Q1mG4p3YmpNeQcxzZhc/vHRVmmMRbqD/EmEwTNEaz2FJlyFpthEnLYYgnZYeknYkog9CvOIPyqnEbzPAwRCtOQ6HaN01W2NKC6YPNlUzDXmS6wewGhCKIhSgxItuaumwMF2BETqg9Tm3iI5+IfwPZlnOhtlbZ+hlDIAm5kAbNFXVnkwmbx+ZEiGvPTxLUmYeDuBrGk226KameXWkMYyIF3jkc4htg1ZcOsDYyxsnsKBca76jguZkH3AAAsBsAmDn+boKBMCUPajhs32UDyDKaneSRDQYS2Db6WAaqNnT1/D4YTFQ8IOqOryZaG3OhXa1/H/qzelQTv3CrSJqFMl5HW5d55rc0LktS+TWVd3hgp+ceGLBb0D4HRfBj4a9a5w7fpwLfUgT+/nUS3wCWzrjmDZWBScOe66wlHK0trCnOzKYK1nnYLbAKcIesSzO/6bjr5jb9j8MD0VjvOFaebN1B3FInp7ibEuhZhDtOjpa7r7R0TpIdGwLZwpw648D+PlU3xZ8X/mITIuAmA4inaVJHtH4jbSJp1uEQRny7lFEfz3kybwVcYXD4VEiORXR98Sh75eAhGn47M22LoVf1I/fj5GKHhLJt/VWdtdes6TZRn5VUR0263j38FenoMUihYcZSf0U7qBzwqr7ElY/DmHJfFNRzQZj+TkN0C3FtpqE3ou+0m0MQa+u1uuqSldpE0nXW2fghsPfyuBn4IeZUVtyHV+nfuae6A3hI/UvP2CensK/7OtPqsRJB/5Esw1+DPra2bsX82dwL+a+7qXyQwd3L/ar7sXtxrvolYG2swyFrh+3HyDo7cjTWEATnJpzBE9j/wxA3X/ieiygFvUMPpd95KmqXDUCNISwvDUNIeTOiD5qMWE930hSlZY7iCS6KawfPjhP3aZugCION6/jgJFGTtKMUeyFCc2++TH93WV2pj25tj29NRN3dnmXAosQ3zzCEpLgpVzMOj19CcF1Fbf54WOTYW49DZdZaUsU1tLusyvy5s8yVejXdbJBmq5jeN/mbQ4AyRfygRcPycJbnxaShqUpjt6AJIdI7YUal6HomoxJ7VCItOXKrbAjaSbB8LpF4ifdInGZ+yHEHUnmuexIsuX0xHVXxDlXi857V4R1BrsiqknUtdZ5fui9qFqneQa1TttqXc9fWFLHZubZmdSpwtGJixsGLW4IIfe9BQ3reAUN+xgFDVt+P+DCChoVp37RgoYtpxOvC/xfc4FvHn+B3/a68Un283Qd4/ausFX8O/F+VEvnZztW1zWqtpGWMzkajR2luzmvAsYrQP144Oiriv3BQJG3XnC4sGHukxemVYpr1Lj4qGEJr++YmmI0CxeOdfKYcUmvPsBNmJU7Rx1bZ+1i56hiuaxZ7x2ljbzREHeOdh639n2PosqrnPo9Co3HJtB2vEehiXHulfco5Kt1W6gHAxHSe+9FEUilA8E0L6wKu4q98qsd5cbWIuiey3rtFap3E3V1YWvOB7cNVFpcRRXW+O+JxKRZ/2mh8vT6LzTpN/8D -------------------------------------------------------------------------------- /img/azuread-automation-workflow.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws-samples/aws-control-tower-customizations-to-automate-saml-20-federation-with-azure-ad/ffc318a6e733ffc13609b821162f049920a3daad/img/azuread-automation-workflow.png -------------------------------------------------------------------------------- /manifest.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | #Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets 3 | region: us-east-1 4 | version: 2021-03-15 5 | 6 | 7 | resources: 8 | 9 | #================================================================================================== 10 | # Azure AD Federation - Management Account 11 | #================================================================================================== 12 | - name: azure-ad-federation-automation-management 13 | resource_file: templates/azuread-fed-management-account.yaml 14 | parameters: 15 | - parameter_key: OrganizationId 16 | #parameter_value: "o-aaa111bbb2222" 17 | parameter_value: "o-fjsp9slj5y" 18 | - parameter_key: SAMLProviderName 19 | parameter_value: "aad" 20 | - parameter_key: IAMUserName 21 | parameter_value: "AzureADAutomationUser" 22 | - parameter_key: IAMUserGroupName 23 | parameter_value: "AzureADAutomationGroup" 24 | - parameter_key: AzureAdFederationAdminRoleName 25 | parameter_value: "AzureAdFederationAdminRole" 26 | - parameter_key: AzureAdFederationAssumeRoleName 27 | parameter_value: "AzureAdFederationAssumeRole" 28 | deploy_method: stack_set 29 | deployment_targets: 30 | accounts: 31 | #- 111122223333 32 | - 679878131213 33 | regions: 34 | - us-east-1 35 | 36 | #================================================================================================== 37 | # Azure AD Federation - Member Account 38 | #================================================================================================== 39 | - name: azure-ad-federation-automation-member 40 | resource_file: templates/azuread-fed-member-account.yaml 41 | parameters: 42 | - parameter_key: ManagementAccountId 43 | #parameter_value: "111122223333" 44 | parameter_value: "679878131213" 45 | - parameter_key: IAMUserName 46 | parameter_value: "AzureADAutomationUser" 47 | - parameter_key: IAMUserGroupName 48 | parameter_value: "AzureADAutomationGroup" 49 | - parameter_key: AzureAdFederationAdminRoleName 50 | parameter_value: "AzureAdFederationAdminRole" 51 | - parameter_key: AzureAdFederationAssumeRoleName 52 | parameter_value: "AzureAdFederationAssumeRole" 53 | deploy_method: stack_set 54 | deployment_targets: 55 | organizational_units: 56 | - Core 57 | #- infrastructure 58 | #- workloads 59 | - Custom 60 | regions: 61 | - us-east-1 62 | -------------------------------------------------------------------------------- /templates/azuread-fed-management-account.yaml: -------------------------------------------------------------------------------- 1 | # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | # SPDX-License-Identifier: MIT-0 3 | # 4 | # Permission is hereby granted, free of charge, to any person obtaining a copy of this 5 | # software and associated documentation files (the "Software"), to deal in the Software 6 | # without restriction, including without limitation the rights to use, copy, modify, 7 | # merge, publish, distribute, sublicense, and/or sell copies of the Software, and to 8 | # permit persons to whom the Software is furnished to do so. 9 | # 10 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, 11 | # INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A 12 | # PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT 13 | # HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION 14 | # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE 15 | # SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 16 | 17 | AWSTemplateFormatVersion: '2010-09-09' 18 | 19 | Parameters: 20 | IAMUserName: 21 | Type: String 22 | Description: The IAM User name to be used to sync the roles for Azure AD federation 23 | Default: AzureADAutomationUser 24 | IAMUserGroupName: 25 | Type: String 26 | Description: The IAM Group name that the IAMUserName will be placed within. 27 | Default: AzureADAutomationGroup 28 | AzureAdFederationAdminRoleName: 29 | Type: String 30 | Description: The name of the role to be created within the management account. Users will sign in with this role to then assume role to the application account. 31 | Default: AzureAdFederationAdminRole 32 | AzureAdFederationAssumeRoleName: 33 | Type: String 34 | Description: The name of the role to be created within the application account. This will be the role assumed from the management account. 35 | Default: AzureAdFederationAssumeRole 36 | OrganizationId: 37 | Type: String 38 | Description: The AWS Organization Id 39 | SAMLProviderName: 40 | Type: String 41 | Description: The name of the SAML Provider. This is used to setup the IAM trust relationship for AzureAdFederationAdminRoleName 42 | 43 | Resources: 44 | # Only allow assumerole from this role to the AzureAdFederationAssumeRole in member accounts 45 | # Only allow the role to view the iam user secret for the IAMUserName user. 46 | AzureAdFederationAdminRole: 47 | Type: AWS::IAM::Role 48 | Properties: 49 | RoleName: !Ref AzureAdFederationAdminRoleName 50 | AssumeRolePolicyDocument: 51 | Version: 2012-10-17 52 | Statement: 53 | - Effect: Allow 54 | Action: 55 | - sts:AssumeRoleWithSAML 56 | Principal: 57 | Federated: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:saml-provider/${SAMLProviderName}" 58 | Condition: 59 | StringEquals: 60 | "SAML:aud": "https://signin.aws.amazon.com/saml" 61 | Policies: 62 | # Allow AssumeRole to all accounts within the AWS Organization to the AzureAdFederationAssumeRoleName role 63 | - PolicyName: AllowAssumeRole 64 | PolicyDocument: 65 | Version: 2012-10-17 66 | Statement: 67 | - Effect: Allow 68 | Action: 69 | - sts:AssumeRole 70 | Resource: !Sub "arn:aws:iam::*:role/${AzureAdFederationAssumeRoleName}" 71 | Condition: 72 | StringEquals: 73 | "aws:PrincipalOrgID": !Ref OrganizationId 74 | # The secretsmanager:ListSecrets action does not support resource-level permissions or condition keys. 75 | # https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecretsmanager.html 76 | - PolicyName: "GetAzureAdIAMUserSecrets" 77 | PolicyDocument: 78 | Version: 2012-10-17 79 | Statement: 80 | - Effect: Allow 81 | Action: 82 | - "secretsmanager:GetSecretValue" 83 | - "secretsmanager:DescribeSecret" 84 | Resource: !Ref CFNUserSecret 85 | - Effect: Allow 86 | Action: 87 | - "secretsmanager:ListSecrets" 88 | Resource: "*" 89 | 90 | # Creates the user only allowing iam:ListRoles. This user is used by Azure AD to sync roles for federation. 91 | CFNUser: 92 | Type: AWS::IAM::User 93 | Properties: 94 | UserName: !Ref IAMUserName 95 | # The iam:ListRoles action does not support resource-level permissions or condition keys. 96 | # https://docs.aws.amazon.com/service-authorization/latest/reference/list_identityandaccessmanagement.html 97 | CFNUserGroupPolicy: 98 | Type: AWS::IAM::ManagedPolicy 99 | Properties: 100 | ManagedPolicyName: "AzureADAllowIAMListRoles" 101 | Path: "/" 102 | PolicyDocument: 103 | Version: 2012-10-17 104 | Statement: 105 | - Effect: Allow 106 | Action: 107 | - "iam:ListRoles" 108 | Resource: "*" 109 | CFNUserGroup: 110 | DependsOn: CFNUserGroupPolicy 111 | Type: AWS::IAM::Group 112 | Properties: 113 | GroupName: !Ref IAMUserGroupName 114 | ManagedPolicyArns: 115 | - !Sub "arn:aws:iam::${AWS::AccountId}:policy/AzureADAllowIAMListRoles" 116 | CFNUserToGroup: 117 | DependsOn: 118 | - CFNUser 119 | - CFNUserGroup 120 | Type: AWS::IAM::UserToGroupAddition 121 | Properties: 122 | GroupName: !Ref IAMUserGroupName 123 | Users: 124 | - !Ref IAMUserName 125 | 126 | # Create and store the IAM access keys for the User 127 | CFNKeys: 128 | Type: AWS::IAM::AccessKey 129 | Properties: 130 | UserName: !Ref CFNUser 131 | 132 | CFNUserSecret: 133 | Type: AWS::SecretsManager::Secret 134 | Properties: 135 | Description: 'These are the secrets for the CFNUser' 136 | Name: 'AzureADFederation/CFNUserSecretAccessKey' 137 | SecretString: !Join [ 138 | '', 139 | [ 140 | '{ "AccessKey": "', 141 | !Ref CFNKeys, 142 | '", "SecretKey": "', 143 | !GetAtt [CFNKeys, SecretAccessKey], 144 | '", "UserName": "', 145 | !Ref IAMUserName, 146 | '" }' 147 | ] 148 | ] 149 | -------------------------------------------------------------------------------- /templates/azuread-fed-member-account.yaml: -------------------------------------------------------------------------------- 1 | # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | # SPDX-License-Identifier: MIT-0 3 | # 4 | # Permission is hereby granted, free of charge, to any person obtaining a copy of this 5 | # software and associated documentation files (the "Software"), to deal in the Software 6 | # without restriction, including without limitation the rights to use, copy, modify, 7 | # merge, publish, distribute, sublicense, and/or sell copies of the Software, and to 8 | # permit persons to whom the Software is furnished to do so. 9 | # 10 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, 11 | # INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A 12 | # PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT 13 | # HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION 14 | # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE 15 | # SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 16 | 17 | AWSTemplateFormatVersion: '2010-09-09' 18 | 19 | Parameters: 20 | IAMUserName: 21 | Type: String 22 | Description: The IAM User name for a new IAM User that will be used to sync the roles for Azure AD federation 23 | Default: AzureADAutomationUser 24 | IAMUserGroupName: 25 | Type: String 26 | Description: The IAM Group name for a new IAM Group that the IAMUserName will be placed within. 27 | Default: AzureADAutomationGroup 28 | AzureAdFederationAdminRoleName: 29 | Type: String 30 | Description: The name of the role that was previously created within the management account. 31 | Default: AzureAdFederationAdminRole 32 | AzureAdFederationAssumeRoleName: 33 | Type: String 34 | Description: The name of the role to be created within the application account. This will be the role assumed from the management account. 35 | Default: AzureAdFederationAssumeRole 36 | ManagementAccountId: 37 | Type: String 38 | Description: The account Id for the management account. 39 | 40 | Resources: 41 | # Only allow assumerole to this role from the AzureAdFederationAdminRole in the Management account 42 | # Only allow the role to view the iam user secret for the IAMUserName user. 43 | AzureAdFederationAssumeRole: 44 | Type: AWS::IAM::Role 45 | Properties: 46 | RoleName: !Ref AzureAdFederationAssumeRoleName 47 | AssumeRolePolicyDocument: 48 | Version: 2012-10-17 49 | Statement: 50 | - Effect: Allow 51 | Action: 52 | - 'sts:AssumeRole' 53 | Principal: 54 | AWS: 55 | - !Sub "arn:aws:iam::${ManagementAccountId}:role/${AzureAdFederationAdminRoleName}" 56 | Policies: 57 | # The secretsmanager:ListSecrets action does not support resource-level permissions or condition keys. 58 | # https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecretsmanager.html 59 | - PolicyName: "GetAzureAdIAMUserSecrets" 60 | PolicyDocument: 61 | Version: 2012-10-17 62 | Statement: 63 | - Effect: Allow 64 | Action: 65 | - "secretsmanager:GetSecretValue" 66 | - "secretsmanager:DescribeSecret" 67 | Resource: !Ref CFNUserSecret 68 | - Effect: Allow 69 | Action: 70 | - "secretsmanager:ListSecrets" 71 | Resource: "*" 72 | 73 | # Creates the user only allowing iam:ListRoles. This user is used by Azure AD to sync roles for federation. 74 | CFNUser: 75 | Type: AWS::IAM::User 76 | Properties: 77 | UserName: !Ref IAMUserName 78 | # The iam:ListRoles action does not support resource-level permissions or condition keys. 79 | # https://docs.aws.amazon.com/service-authorization/latest/reference/list_identityandaccessmanagement.html 80 | CFNUserGroupPolicy: 81 | Type: AWS::IAM::ManagedPolicy 82 | Properties: 83 | ManagedPolicyName: "AzureADAllowIAMListRoles" 84 | Path: "/" 85 | PolicyDocument: 86 | Version: 2012-10-17 87 | Statement: 88 | - Effect: Allow 89 | Action: 90 | - "iam:ListRoles" 91 | Resource: "*" 92 | CFNUserGroup: 93 | DependsOn: CFNUserGroupPolicy 94 | Type: AWS::IAM::Group 95 | Properties: 96 | GroupName: !Ref IAMUserGroupName 97 | ManagedPolicyArns: 98 | - !Sub "arn:aws:iam::${AWS::AccountId}:policy/AzureADAllowIAMListRoles" 99 | CFNUserToGroup: 100 | DependsOn: 101 | - CFNUser 102 | - CFNUserGroup 103 | Type: AWS::IAM::UserToGroupAddition 104 | Properties: 105 | GroupName: !Ref IAMUserGroupName 106 | Users: 107 | - !Ref IAMUserName 108 | 109 | # Create and store the IAM access keys for the User 110 | CFNKeys: 111 | Type: AWS::IAM::AccessKey 112 | Properties: 113 | UserName: !Ref CFNUser 114 | 115 | CFNUserSecret: 116 | Type: AWS::SecretsManager::Secret 117 | Properties: 118 | Description: 'These are the secrets for the CFNUser' 119 | Name: 'AzureADFederation/CFNUserSecretAccessKey' 120 | SecretString: !Join [ 121 | '', 122 | [ 123 | '{ "AccessKey": "', 124 | !Ref CFNKeys, 125 | '", "SecretKey": "', 126 | !GetAtt [CFNKeys, SecretAccessKey], 127 | '", "UserName": "', 128 | !Ref IAMUserName, 129 | '" }' 130 | ] 131 | ] 132 | --------------------------------------------------------------------------------