Amazon AppStream 2.0 can be federated with G Suite third-party SAML 2.0 which will allow users to access the stack and start streaming applications. This blog post will walk you through the steps to successfully configure and enable federation for AppStream 2.0 stack using Google (G Suite) as the identity provider (IdP).
Before you begin, you must have:
- An AWS account
- An Amazon AppStream 2.0 stack, configured and working
- A G Suite subscription with an admin account
I. Download Google Metadata
- Login to G Suite Admin Console – Apps – SAML apps
- Open SAML apps, click on
(Enable SSO for SAML Applcation). - Type “Amazon Web Services” in the search box and click on the arrow.
- Download and save the IDP metadata option to your local computer to be used later.
II. Create Google SAML 2.0 Identity Provider
- Login to AWS console and navigate to IAM dashboard.
- Click on Identity Providers -> Create Provider
- Select the following:
- Provider Type: SAML
- Provider Name: Give it-a-name, for this demo, will name it GoogleSSO
- Metadata Document: upload the file you downloaded in #4 above.
- Click next, and create.
III. Configure AppStream IAM Role in AWS
The IAM role grants users the permissions to access the stack.
- In IAM dashboard, click on Role, Create role
- Role type, choose SAML 2.0 federation
- SAML Provider, select the SAML IdP that you created in #5 above.
- DO NOT choose either of the two SAML 2.0 access methods (Allow programmatic access only or Allow programmatic and AWS Management Console access)
- Attribute, choose SAML: sub_type.
- Value, type persistent
- Click next:permission, next:Tags,next:Review
- Type in role name and create. For this demo, it is named: DemoAppstreamAccessRole
IV. Create and embed an Inline Policy
The inline policy provides permission needed by federated users to access to the AppStream 2.0 stack. Create the policy using the below sample and embed in the role created in section V. above. Change the region code, account id, and stack name to reflect what you have.
- REGION-CODE: AWS Region where your AppStream 2.0 stack exists
- ACCOUNT-ID: Your AWS account ID with no space or hyphens
- STACK-NAME: The name of the stack. This is case sensitive and must be exact.
- Example: arn:aws:appstream:us-west-2:123456789012:stack/DemoApps
Example: arn:aws:appstream:us-west-2:123456789012:stack/
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "appstream:Stream",
"Resource": "arn:aws:appstream:REGION-CODE:ACCOUNT-ID:stack/STACK-NAME",
"Condition": {
"StringEquals": {
"appstream:userId": "${saml:sub}"
}
}
}
]
}
V. Configure Federation Relay State
Configure the relay state of your federation to point to the AppStream 2.0 URL. The relay state is the stack portal to which users are forwarded after successful authentication by AWS.
Use the below format and change the relay state region endpoint, stack name, and account id with yours. This will be used as the start URL for Google IdP configuration.
To find out the relay state endpoints for a particular region, refer to this link.
Example: https://appstream2.us-west-2.aws.amazon.com/saml?stack=DemoApps&accountId=123456789012
Relay state URL format: https://relay-state-region-endpoint?stack=stackname&accountId=aws-account-id
VI. Create Attributes and SAML 2.0 In G Suite
- Login to G Suite Admin Console
- Select Users, click on “More” and select “Managed custom attributes“
- Click on “ADD CUSTOM ATTRIBUTE“
-
Category: Enter name for example SAML-USER-ATTRIBUTE Description: Enter a description Custom Field 1: FederationRole, Text, Visible to user and admin, Single Value Custom Field 2: SessionDuration, Whole Number, Visible to user and admin, Single Value
- At the G Suite Admin Console, navigate to Apps – SAML apps
- Open SAML apps, click on (Enable SSO for SAML Applcation).
- Click on “SETUP MY OWN CUSTOM APP“
- Click Next on the Google IdP Information
- Enter the application name and upload an optional logo if needed. Click Next.
-
Enter the following in the Service Provider details and click Next ACS URL *: https://signin.aws.amazon.com/saml Entity ID *: https://signin.aws.amazon.com/saml Start URL: relay state url created in section V Certificate: Leave as is. No Change Signed Response: DO NOT Check. Leave blank Name ID: Basic Information, Primary Email Name ID Format: PERSISTENT
-
Enter the following in Attribute Mapping and click Finish. https://aws.amazon.com/SAML/Attributes/RoleSessionName, Basic Information, Primary Email https://aws.amazon.com/SAML/Attributes/Role,SAML-USER-ATTRIBUTE, FederationRole https://aws.amazon.com/SAML/Attributes/SessionDuration, SAML-USER-ATTRIBUTE, SessionDuration
- Click OK to complete setup.
- At the G Suite Admin Console, navigate to Users, select a user, expand the user information, edit the the “SAML-USER-ATTRIBUTE” with the following information. and save once complete. The Role-ARN and IDP-ARN is what was created in section II and III above.
-
FederationRole: Role-ARN, IDP-ARN Example: arn:aws:iam::123456789012:role/DemoAppstreamAccessRole,arn:aws:iam::123456789012:saml-provider/GoogleSAML SessionDuration: max duration in seconds of AppStream 2.0. Enter 3600 for this demo Example: 3600
VII. Turn on SAML 2.0 AppStream App
At the G Suite Admin Console, go to Apps, SAML Apps, Edit the AppStream 2.0 application and turn on for Everyone or by selective Organizational Unit
Test your AppStream 2.0 federation by clicking the application menu in the far right and launch the selected app.
A successful login should look something like this:
Additional Information:
- https://docs.aws.amazon.com/appstream2/latest/developerguide/external-identity-providers-setting-up-saml.html#external-identity-providers-relay-state
