GSuite-as-identity-Provider-IdP-for-AWS-Amazon-Web-Services

Use GSuite accounts for AWS

Google Admin pre-requirements

Add custom user attributes (for AWS SAML binding attributes)

Gsuite Admin Help
AWS Docs
GSuite Admin > Users > Manage user attributes

1. Add AWS SAML Role Attribute (Text, Multi-value)
2. (Optional) Add AWS SAML RoleSessionName Attribute (Text, Single Value)

Set up SAML app (choose Amazon-Web-Services)

Create a new SAML App (choose Amazon-Web-Services)

GSuite Admin > Apps > SAML Apps

Download IDP Metadata (XML)

Edit Service Provider Details

Name ID = Basic Information > Primary Email
Name ID Format = Email

Set Attribute Mapping (AWS Docs)

https://aws.amazon.com/SAML/Attributes/RoleSessionName
https://aws.amazon.com/SAML/Attributes/Role
https://aws.amazon.com/SAML/Attributes/SessionDuration

Config AWS IAM Provider

Create the GSuite Provider in AWS Console

AWS > IAM > Access management > Identity providers

Configure Provider

Set a friendly name
Set provider type to SAML
Select the Gsuite IDP Metadata (XML file)

Configure IAM Role(s) in AWS Console

For this example we will create 2 roles, 1 administrator and 1 Read only role
If an user has 2+ assigned roles, he can chose the desired role

AWS > IAM > Access management > Roles

Create SAML Role (Administrator)

AWS > IAM > Access management > Roles > Create role

Select AdministratorAccess policy
Name: Administrator

Create SAML Role (ViewOnlyAccess)

Do the same as for Administrator but with the ViewOnlyAccess policy
Name: ViewOnlyAccess

As we can see here we have now 2 new roles Administrator and ViewOnlyAccess

Configure GSuite role (user attribute)

AWS Doc

Find Role(s) ARN

Find GSuite Identity provider ARN

Set GSuite user attribute

Format of the AWS SAML Role Attribute:
arn:aws:iam::account-number:role/role-name1,arn:aws:iam::account-number:saml-provider/provider-name
SAML SessionDuration Attribute in seconds

Check the set-up

Open Google & launch the AWS Quick link

Select the AWS Role (if you have assigned multiples roles to a GSuite user)

Check AWS user details

Next steps

• Create GSuite Groups and auto assign roles based on the user's groups