AWS IAM Identity Center SSO

In this guide, you're going to learn how to connect the AWS IAM Identity Center with Better Stack to enable single sign-on (SSO) for you and your colleagues.

1. Start the SSO set-up by going to Single Sign-On configuration. Note that only organization admins have access to these settings.

2. On this page click Connect on the Generic SAML SSO panel.

3. Select AWS IAM Identity Center from the list of supported providers.

4. Take note of the values in the Entity ID and ACS URL fields, we're going to need these in a second.

We're going to switch to the AWS console now:

1. Navigate to the IAM Identity Center AWS product.

2. Under Application assignment click on Applications.

3. Click on Add Application.

4. Under Setup preference select I have an application I want to set up.

5. Under Application Type select SAML 2.0.

6. Click Next to continue.

7. Fill in Display name with Better Stack.

8. Copy the IAM Identity Center SAML issuer URL, we're going to need this in a second.

9. Under IAM Identity Center Certificate, click Download. We'll need that certificate file in a second as well.

10. Under Application metadata select Manually type your metadata values.

11. Fill in Application ACS URL with the ACS URL copied from Better Stack.

12. Fill in Application SAML audience with the Entity ID copied from Better Stack.

13. Click Submit to continue.

14. Click on Actions, then select Edit attribute mappings from the dropdown.

15. Under the Subject attribute, enter ${user:email} as the user attribute, then under Format select emailAddress.

16. Click Add new attribute mapping, fill in first_name, and ${user:givenName}, then under Format select basic.

17. Click Add new attribute mapping, fill in last_name, and ${user:familyName}, then under Format select basic.

18. Click Add new attribute mapping, fill in email, and ${user:email}, then under Format select basic.

19. Click Save changes.

20. At the bottom, click Assign users and groups.

21. Assign yourself as a user to the application. This is necessary to test the connection of the application with your Better Stack account. Make sure your user's email address matches the one you use on Better Stack.

We're going to switch back to Better Stack now:

1. Fill in Identity Provider Single Sign-On URL with the IAM Identity Center SAML issuer URL copied above.

2. Next to X.509 Certificate click Upload and select the certificate file downloaded above.

3. Click Connect to confirm the configuration. You will be redirected to an AWS sign-in page. Sign in with the account you assigned to the Better Stack application, please.

Tada! Your Single Sign-On with AWS IAM Identity Center is now configured!