Switching the Identity Provider in the IAM Identity Center while keeping all permissions intact and minimizing disruptions can be a daunting task. In this post I’m explaining how we solved this for one of our customers.
IAM Identity Center, formerly AWS SSO, is often used as an access management solution in front of one or more AWS accounts. More often than not, its purpose is to grant access to AWS accounts within an AWS organization. Today we’ll shed some light on the basic concepts and explain how this solution can be integrated with Azure AD which has recently been renamed to Entra ID to provide Single-Sign-On to your AWS environment.
It’s probably not a surprise that (almost) everything Amazon Web Services offers is accessible through web services. AWS also provides a range of SDKs that make interfacing with and integrating them in your code base relatively painless. These SDKs are sometimes a bit limited, though. There are certain things that you can only do through the AWS console, meaning that there are still services under the surface, but they’re undocumented and not accessible through the official SDKs. That API call is what we refer to as an undocumented API. In this post, I’m going to show you how to discover these APIs and use them in your scripts.
