Configuring AWS Control Tower with AWS SSO and Azure AD

Limitations:

AWS SSO Limitations:

• a. AWS SSO can only be used with AWS Control Tower in the same AWS Region.
• b. AWS SSO can be associated with only one AWS Control Tower instance at a time.
• c. AWS SSO can only federate with one external identity provider (IdP) at a time.

Azure Active Directory (AAD) Limitations:

• a. Azure AD can only be used as an external identity provider (IdP) with AWS SSO, which then integrates with AWS Control Tower.
• b. Azure AD must be configured as a SAML-based IdP to integrate with AWS SSO.
• c. There might be certain limitations or restrictions specific to Azure AD features or configurations when used in conjunction with AWS SSO.

Control Tower Limitations:

• a. Control Tower supports only SAML-based federation for single sign-on (SSO) with AWS SSO.
• b. Control Tower doesn’t support other identity federation protocols like OpenID Connect (OIDC).
• c. Control Tower currently supports only one AWS account as the management account.

Miscellaneous Limitations:

• a. Ensure compatibility of SAML versions between AWS SSO and Azure AD. AWS SSO supports SAML 2.0, but Azure AD might support multiple versions. Verify compatibility and adjust SAML configurations accordingly.

---

Considerations:

When configuring AWS Control Tower with AWS SSO and Azure Active Directory (AAD), there are several considerations to keep in mind:

1. Identity Source and User Management:
   • a. Decide on the primary identity source for user management. In this case, it would be either AWS SSO or Azure AD. Consider factors such as user provisioning, synchronization, and group management capabilities each identity source provides.
   • b. Determine how AWS SSO and Azure AD will synchronize user accounts and groups. This can be done manually or by leveraging automation tools like AWS Directory Service or Azure AD Connect.
2. SAML Configuration:
   • a. Ensure that the SAML configurations between AWS SSO and Azure AD are compatible. Verify the SAML versions supported by each service and adjust the configuration accordingly.
   • b. Pay attention to the SAML attributes and claims mapping to ensure that user attributes like usernames, email addresses, and roles are correctly mapped and passed between the services.
3. Security and Access Control:
   • a. Define appropriate access controls and permissions for users and groups in both AWS SSO and AWS Control Tower. This includes assigning roles and policies within AWS Control Tower to ensure proper access to resources and guardrails.
   • b. Implement multi-factor authentication (MFA) to enhance security for user access to AWS Control Tower and associated AWS accounts.
   • c. Regularly review and update user access permissions as needed, especially when user roles or responsibilities change.
4. Regional Considerations:
   • a. Keep in mind that AWS SSO and AWS Control Tower need to be set up in the same AWS Region. Consider the availability and performance requirements of your AWS resources and choose the appropriate AWS Region for deployment.
   • b. Consider any data residency or compliance requirements when selecting the AWS Region and configuring AWS Control Tower and associated services.
5. Monitoring and Auditing:
   • a. Implement logging and monitoring solutions to track user access, changes to permissions, and any suspicious activities within AWS Control Tower and associated AWS accounts.
   • b. Regularly review audit logs and generate reports to ensure compliance with security and regulatory requirements.
6. Documentation and Training:
   • a. Document the configuration steps, settings, and any customizations made during the integration process for future reference.
   • b. Provide training and guidance to users, administrators, and support teams on using and managing AWS Control Tower, AWS SSO, and Azure AD integration.

Configuration:

To configure AWS Control Tower with AWS Single Sign-On (SSO) and Azure Active Directory (AAD), you need to follow these steps:

1. Set up AWS Control Tower:
   • a. Log in to your AWS Management Console.
   • b. Navigate to the AWS Control Tower service.
   • c. Follow the provided documentation or wizard to set up AWS Control Tower in your AWS account. This includes setting up the Control Tower lifecycle, organizational units (OUs), and guardrails.
2. Set up AWS SSO:
   • a. Navigate to the AWS SSO service in the AWS Management Console.
   • b. Follow the documentation or wizard to set up AWS SSO in your AWS account.
   • c. Configure user attributes and identity sources as required.
3. Set up Azure Active Directory (AAD):
   • a. Log in to the Azure portal.
   • b. Navigate to Azure Active Directory.
   • c. Follow the documentation or wizard to set up Azure AD in your Azure subscription.
   • d. Configure user attributes and identity sources as required.
4. Set up federation between AWS SSO and AAD:
   • a. In the AWS SSO console, go to Settings.
   • b. Under Identity Source, choose “Add new identity source.”
   • c. Select “SAML” as the type and provide a name for the identity source.
   • d. Download the AWS SSO metadata file.
   • e. In the Azure portal, go to Azure Active Directory.
   • f. Navigate to the Enterprise applications section and select “New application.”
   • g. Choose “Non-gallery application” and provide a name for the application.
   • h. Under Single sign-on, select SAML.
   • i. Upload the AWS SSO metadata file.
   • j. Configure the SAML settings according to the AWS SSO documentation.
   • k. Save the SAML configuration.
5. Assign users and groups to AWS Control Tower:
   • a. In the AWS SSO console, go to the AWS accounts tab.
   • b. Select the AWS Control Tower account and click on “Assign users/groups.”
   • c. Choose the appropriate users and groups from the AWS SSO directory.
   • d. Grant the necessary permissions for Control Tower access.
6. Test the configuration:
   • a. Log in to the Azure portal using an account from AAD.
   • b. Navigate to the AWS Management Console using the AWS SSO link.
   • c. You should be able to access Control Tower resources based on the assigned permissions.