ECS 3.6.2 Data Access Guide

AssumeRoleWithSAML

In order to use AssumeRoleWithSAML, you must configure your SAML identity provider (IdP) to issue the claims required by ECS.

• IAM role must be created that specifies this SAML Provider in the trust policy.
• AssumeRoleWithSAML returns a set of temporary security credentials for users who have been authenticated through a SAML authentication response.
• This operation provides a mechanism for tying an enterprise identity store or directory to role-based access without user-specific credentials or configuration.
• Calling AssumeRoleWithSAML does not require the use of ECS security credentials. The identity of the caller is validated by the claims that are provided in the SAML Assertions by the identity provider.
• Temporary credentials consist of an access key ID, a secret access key, and a security token.
• Following condition keys are supported in the AssumeRolePolicyDocument.
  • saml:aud
  • saml:iss
  • saml:sub
  • saml:sub_type
  • saml:edupersonorgdn
  • saml:namequalifier

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Principal":{
            "Federated":"urn:aws:iam::s3:saml-provider/provider1"
         },
         "Action":"sts:AssumeRoleWithSAML",
         "Condition":{
            "StringEquals":{
               "SAML:sub":"<Idp>\\Bob",
               "SAML:aud":"https://10.247.179.105/saml",
               "SAML:eduPersonOrgDN":[
                  "ECS",
                  "Atmos"
               ],
               "SAML:iss":"http://AD.<Idp>.emc.com/<Idp>/services/trust"
            }
         }
      }
   ]
}