Skip to main content

Integrate with Amazon Web Services (IAM Identity Center)

Support level: authentik

What is AWS?​

AWS, or Amazon Web Services, is a comprehensive cloud computing platform. It provides a wide array of on-demand IT services like computing power, storage, and databases, allowing businesses to build and run applications, and manage infrastructure through the internet.

-- https://aws.amazon.com

Preparation​

The following placeholders are used in this guide:

  • authentik.company is the FQDN of the authentik installation.

You need an AWS account with IAM Identity Center enabled and permissions to change the IAM Identity Center identity source.

info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

User provisioning

IAM Identity Center requires users to exist before they can log in with an external identity provider. You can create users manually in IAM Identity Center or configure SCIM provisioning from authentik.

Classic IAM

SCIM provisioning is only supported with IAM Identity Center. It is not supported with Amazon Web Services (Classic IAM).

Download the service provider metadata​

  1. Log in to the AWS Management Console as an administrator.
  2. Navigate to IAM Identity Center > Settings > Identity source.
  3. Click Actions > Change identity source.
  4. Select External identity provider and click Next.
  5. Under Service provider metadata, click Download metadata file.
  6. Note the AWS access portal sign-in URL.
  7. Keep this browser tab open. You need to return to it after you configure authentik.

authentik configuration​

To support the integration of AWS IAM Identity Center with authentik, you need to create an application/provider pair in authentik.

Create an application and provider​

SAML provider changes in authentik 2026.5

authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the Issuer value to: https://authentik.company/application/saml/<application_slug>/metadata/

Older versions of authentik set this value to authentik by default. If you're running an older version, please set Issuer to https://authentik.company/application/saml/<application_slug>/metadata/, where <application_slug> is the slug that you selected for the application.

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Applications > Applications and click New Application to open the application wizard.

    • Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
      • Under UI Settings, set Launch URL to the AWS access portal sign-in URL that you copied from AWS.
    • Choose a Provider type: select SAML Provider from metadata as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), upload the service provider metadata file that you downloaded from AWS, and configure the following required settings.
      • Under Advanced protocol settings, select an available Signing Certificate.
      • Under Advanced protocol settings, set NameID Property Mapping to authentik default SAML Mapping: Email.
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's Application Dashboard page.

  3. Click Submit to save the new application and provider.

User identifier

AWS matches the SAML NameID value to the user's IAM Identity Center username, not to the user's email attribute. If you provision users with SCIM, configure the SCIM user mapping so that the IAM Identity Center username uses the same value as the SAML NameID.

Download the identity provider metadata​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Applications > Providers and click the AWS provider that you created.
  3. Under Related objects > Metadata, click Download. This metadata file is required in the next section.

AWS configuration​

Complete the SAML setup​

  1. Return to the AWS IAM Identity Center browser tab from the previous section.
  2. Under Identity provider metadata > IdP SAML metadata, click Choose file and upload the metadata file that you downloaded from authentik.
  3. Click Next.
  4. Type ACCEPT in the confirmation field.
  5. Click Add/Change Identity Provider.

Enable automatic provisioning (optional)​

IAM Identity Center supports SCIM provisioning for users and groups from authentik.

Complete the SAML setup before you configure SCIM provisioning.

  1. Log in to the AWS Management Console as an administrator.
  2. Navigate to IAM Identity Center > Settings.
  3. In the Automatic provisioning info box, click Enable.
    • If automatic provisioning is already enabled, click Actions > Manage provisioning under Identity source.
  4. Note the SCIM endpoint and Access token. These values are required when you configure the SCIM provider in authentik.

Configure SCIM property mappings (optional)​

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Customization > Property Mappings and click Create.

  3. Select SCIM Provider Mapping and click Next.

  4. Configure the AWS user mapping:

    • Name: provide a name that sorts after authentik default SCIM Mapping: User, such as zz AWS SCIM User.
    • Expression:
    return {
        "photos": None,
        "userName": request.user.email,
    }

  5. Click Finish.

This mapping removes the photos attribute and maps the IAM Identity Center username to the user's email address so that it matches the SAML NameID configured earlier.

Configure a SCIM provider (optional)​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Providers > Providers and click Create.
  3. Select SCIM Provider as the provider type.
  4. Configure the provider with the following settings:
    • Provide a descriptive name.
    • Under Protocol settings, set URL to the SCIM endpoint from AWS.
    • Under Protocol settings, set Token to the Access token from AWS.
    • Under Protocol settings, set Compatibility Mode to AWS.
    • If you want to test provisioning without writing changes to AWS, enable Dry run mode.
    • Configure user filtering and group filtering for the users and groups that authentik should provision.
    • Under User Property Mappings, add authentik default SCIM Mapping: User and the AWS user mapping that you created.
    • Under Group Property Mappings, add authentik default SCIM Mapping: Group.
  5. Click Finish.
  6. Navigate to Applications > Applications and open the AWS application.
  7. Click Edit.
  8. Set Backchannel providers to the AWS SCIM provider that you created.
  9. Click Update.

The SCIM provider syncs when users, groups, or memberships change. You can also start a manual sync from the SCIM provider page.

Configuration verification​

To confirm that authentik is properly configured with AWS IAM Identity Center, open the AWS application from the authentik User interface. The AWS access portal should open without prompting for another sign-in. If you configured SCIM, confirm that the expected users and groups appear in IAM Identity Center.

Resources​