Add Okta as a trusted source for AWS roles

After you configure Okta as the Amazon Web Services (AWS) account identity provider, you create or update existing IAM roles for Okta to retrieve and assign to users. Okta can only provide single sign-on (SSO) for users with roles that have been configured to grant access to the Okta SAML identity provider you configured in Configure AWS accounts and roles for SAML SSO.

Grant SSO access to an existing role
Grant SSO access to a new role

Grant SSO access to an existing role

On the AWS Management Console, click Roles in the left pane.
Select the role that you would like to permit Okta SSO access to.
Select the Trust Relationship tab for the role, then click Edit Trust Relationship.
Modify the IAM trust relationship policy to permit SSO into Okta using the SAML IDP you previously configured:
- If the policy document is empty, you can copy and paste the provided policy and replace <COPY & PASTE SAML ARN VALUE HERE> with the Amazon Resource Name (ARN).

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "<COPY & PASTE SAML ARN VALUE HERE>"
},
"Action": "sts:AssumeRoleWithSAML",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}

If you have a current trust relationship in place, then you may need to modify your existing policy document to also include Okta SSO access. At a minimum, you will need to include everything within the Statement code block.

Grant SSO access to a new role

On the AWS Management Console, click Roles in the left pane.
Go to RolesCreate Role.
Use SAML 2.0 federation type of trusted entity.
Select Okta (name of your identity provider) as the SAML provider and Allow programmatic and AWS Management Console access, then proceed to Permissions.
Select your preferred policy to be assigned to the role you're creating.
Finish Role configuration.

Next steps

Generate the AWS API access key