Skip to main content

Integrate with Amazon Web Services (Classic IAM)

Support level: authentik

What is AWS?​

AWS, or Amazon Web Services, is a comprehensive cloud computing platform. It provides a wide array of on-demand IT services like computing power, storage, and databases, allowing businesses to build and run applications, and manage infrastructure through the internet.

-- https://aws.amazon.com

Preparation​

The following placeholders are used in this guide:

  • authentik.company is the FQDN of the authentik installation.

You need an AWS account with permissions to create IAM identity providers, IAM roles, and IAM policies.

info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

IAM Identity Center

Classic IAM SAML federation is best suited for legacy or single-account AWS console access. For centralized workforce access, multi-account access, or SCIM provisioning, use Amazon Web Services (IAM Identity Center).

OIDC federation

AWS Classic IAM also supports OIDC identity providers for web identity federation and temporary AWS credentials. OIDC does not provide direct sign-in to the AWS Management Console, so this guide uses SAML for console SSO.

authentik configuration​

SAML provider changes in authentik 2026.5

authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the Issuer value to: https://authentik.company/application/saml/<application_slug>/metadata/

Older versions of authentik set this value to authentik by default. If you're running an older version, please set Issuer to https://authentik.company/application/saml/<application_slug>/metadata/, where <application_slug> is the slug that you selected for the application.

To support the integration of AWS Classic IAM with authentik, you need to create SAML property mappings, an application/provider pair, and application entitlements for the AWS IAM roles that users can assume.

Create property mappings​

Before creating the AWS role mapping, note your AWS account ID and choose the name that you will use for the SAML provider in AWS, such as authentik.

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Customization > Property Mappings and click Create.

  3. Select SAML Provider Property Mapping and click Next.

  4. Configure the role mapping for application entitlement-based role assignment:

    • Name: provide a descriptive name, such as AWS Role.
    • SAML Attribute Name: https://aws.amazon.com/SAML/Attributes/Role
    • Friendly Name: leave blank.
    • Expression:
    ACCOUNT_ID = "<aws_account_id>"
    PROVIDER_NAME = "<provider_name>"

    return [
        (
            f"arn:aws:iam::{ACCOUNT_ID}:role/{entitlement.name},"
            f"arn:aws:iam::{ACCOUNT_ID}:saml-provider/{PROVIDER_NAME}"
        )
        for entitlement in request.user.app_entitlements(provider.application)
    ]

  5. Click Finish.

  6. Create another SAML Provider Property Mapping for the AWS role session name:

    • Name: provide a descriptive name, such as AWS Role Session Name.
    • SAML Attribute Name: https://aws.amazon.com/SAML/Attributes/RoleSessionName
    • Friendly Name: leave blank.
    • Expression:
    session_name = regex_replace(user.username, r"[^a-zA-Z0-9+=,.@-]", "-")[:64]
    return session_name if len(session_name) >= 2 else "ak-user"

  7. Click Finish.

This role mapping returns one role/provider ARN pair for each AWS role entitlement assigned to the user. If a user receives one role, AWS opens that role directly. If a user receives multiple roles, AWS prompts them to select which role to assume.

If you do not want to use application entitlements for role assignment, return one or more static role and provider ARN pairs from the role mapping instead. For a single static role, use this expression:

return (
    "arn:aws:iam::<aws_account_id>:role/authentik-admin,"
    "arn:aws:iam::<aws_account_id>:saml-provider/<provider_name>"
)

For multiple static roles, use this expression:

return [
    (
        "arn:aws:iam::<aws_account_id>:role/authentik-admin,"
        "arn:aws:iam::<aws_account_id>:saml-provider/<provider_name>"
    ),
    (
        "arn:aws:iam::<aws_account_id>:role/authentik-read-only,"
        "arn:aws:iam::<aws_account_id>:saml-provider/<provider_name>"
    ),
]

The role session name mapping determines how the user is identified in AWS audit logs and in the AWS console. AWS displays the assumed role session in the format <role_name>/<session_name>.

Configure session duration (optional)​

AWS supports the SessionDuration SAML attribute for AWS Management Console sessions. To set the requested session duration from authentik, create another SAML Provider Property Mapping:

  • Name: provide a descriptive name, such as AWS Session Duration.
  • SAML Attribute Name: https://aws.amazon.com/SAML/Attributes/SessionDuration
  • Friendly Name: leave blank.
  • Expression: return the requested duration in seconds, such as return "3600".

The value must be between 900 and 43200 seconds and cannot exceed the maximum session duration configured on the IAM role.

Create an application and provider​

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Applications > Applications and click New Application to open the application wizard.

    • Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
    • Choose a Provider type: select SAML Provider as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
      • ACS URL: https://signin.aws.amazon.com/saml
      • Audience: urn:amazon:webservices
      • Under Advanced protocol settings, select an available Signing Certificate.
      • Under Advanced protocol settings, enable Sign responses and keep Sign assertions enabled.
      • Under Advanced protocol settings > Property mappings, add the AWS role mapping, AWS role session name mapping, and optional AWS session duration mapping that you created.
      • Under Advanced protocol settings, set NameID Property Mapping to authentik default SAML Mapping: Email.
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's Application Dashboard page.

  3. Click Submit to save the new application and provider.

AWS Classic IAM accepts an email-formatted NameID. The default authentik SAML email mapping provides that value.

Create application entitlements for AWS roles​

Use application entitlements to represent the AWS IAM roles that this application should expose.

  1. Open the AWS application that you created in the authentik Admin interface.
  2. Click the Application entitlements tab.
  3. Create one entitlement for each AWS IAM role that users should be able to assume, such as authentik-admin or authentik-read-only.
  4. Bind the appropriate users or groups to each entitlement.
Entitlement role names

For this integration, each entitlement name must exactly match the corresponding AWS IAM role name. This keeps AWS-specific authorization scoped to the AWS application instead of relying on global group names.

Download the metadata file​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Applications > Providers and click the AWS provider that you created.
  3. Under Related objects > Metadata, click Download. This metadata file is required in the next section.

AWS configuration​

Create a SAML identity provider​

  1. Log in to the AWS Management Console as an administrator.
  2. Navigate to IAM > Identity providers.
  3. Click Add provider and configure the following settings:
    • Provider type: select SAML.
    • Provider name: enter the provider name that you used in the authentik role mapping.
    • Metadata document: upload the metadata file that you downloaded from authentik.
  4. Click Add provider.

Create IAM roles for SAML federation​

Create one IAM role for each application entitlement that you created in authentik.

  1. In the IAM console, navigate to Access management > Roles.
  2. Click Create role.
  3. Under Trusted entity type, select SAML 2.0 federation.
  4. Under SAML 2.0-based provider, select the SAML provider that you created.
  5. Under Access to be allowed, select the access mode that matches how users should use the role:
    • Allow programmatic and AWS Management Console access: users can access the AWS Management Console and use temporary credentials.
    • Allow programmatic access only: users can use temporary credentials, but not console SSO.
  6. Under Sign-in endpoint type, select the endpoint type for your environment:
    • Regional endpoint: AWS uses a region-specific sign-in URL.
    • Non-Regional endpoint: AWS uses the global sign-in URL.
  7. Click Next.
  8. Select the permissions policies that define access for this role.
  9. Click Next.
  10. Set Role name to the matching entitlement name in authentik, such as authentik-admin.
  11. Optionally add a description and tags.
  12. Click Create role.

Repeat these steps for each AWS role that users should be able to assume.

Verify the role trust policy​

For each IAM role, confirm that the trust policy allows SAML federation from the authentik SAML provider.

  1. Navigate to IAM > Roles and click the role that you created.

  2. Go to the Trust relationships tab and click Edit trust policy.

  3. AWS can create a trust policy with a session-specific ACS URL similar to this:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                    "Federated": "arn:aws:iam::<aws_account_id>:saml-provider/<provider_name>"
                },
                "Action": "sts:AssumeRoleWithSAML",
                "Condition": {
                    "StringEquals": {
                        "SAML:aud": "https://signin.aws.amazon.com/saml/acs/AAAAAA"
                    }
                }
            }
        ]
    }

  4. Update SAML:aud to the generic AWS SAML sign-in URL:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                    "Federated": "arn:aws:iam::<aws_account_id>:saml-provider/<provider_name>"
                },
                "Action": "sts:AssumeRoleWithSAML",
                "Condition": {
                    "StringEquals": {
                        "SAML:aud": "https://signin.aws.amazon.com/saml"
                    }
                }
            }
        ]
    }

  5. Click Update policy.

Configure OIDC federation (optional)​

Use this path only for AWS IAM web identity federation, such as CI/CD pipelines, automation, or workloads that exchange OIDC tokens for temporary AWS credentials. It does not configure AWS Management Console SSO.

  1. In authentik, create an application/provider pair with OAuth2/OpenID Connect as the provider type.
    • Application: provide a descriptive name, note the application Slug, and configure an optional group for the type of application, the policy engine mode, and optional UI settings.
    • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
      • Note the Client ID.
      • Select an available signing key.
      • Under Advanced protocol settings > Selected Scopes, add authentik default OAuth Mapping: OpenID 'entitlements' if your role trust policies use entitlement claims.
  2. In the AWS Management Console, navigate to IAM > Identity providers.
  3. Click Add provider and configure the following settings:
    • Provider type: select OpenID Connect.
    • Provider URL: https://authentik.company/application/o/<application_slug>/
    • Audience: enter the Client ID from authentik.
  4. Click Add provider.
  5. Open the identity provider that you created and click Assign role to create or select the IAM role that trusts this provider.

Configuration verification​

To confirm that authentik is properly configured with AWS Classic IAM, open the AWS application from the authentik User interface. If your user has access to more than one AWS role, AWS prompts you to choose a role. After you select a role, the AWS Management Console opens and shows your assumed role session in the account menu in the format <role_name>/<session_name>.

Resources​