Cloudformation-coverage-roadmap: AWS::IAM::SAMLProvider - New Resource

Created on 31 Jul 2019 · 8Comments · Source: aws-cloudformation/cloudformation-coverage-roadmap

Title -> AWS::IAM::SAMLProvider

Scope of request -> Ability to natively create a SAML provider in CloudFormation, currently a custom resource is required.

Expected behavior -> A SAML provider is created, updated or removed. Metadata file could potentially be referenced as an s3 URI similar to a custom resource with CloudFormation package support to upload a local metadata file.
An Update should update the metadata file.

Category (required) -> Security / IAM

security identity compliance

Source

thomasmcgannon

👍91

Most helpful comment

@atkinsonm I will say on this occasion, it's actually hard. I worked with Rich on trying to produce a Resource Type for this blog, but there's an underlying challenge in the way this _specific_ type needs to handle AuthN/AuthZ which made it challenging in the current architecture. This is something we are working to address.

rjlohan on 15 Jun 2020

👍3

All 8 comments

:: needed instead of the single : between IAM and SAMLProvider.

iann0036 on 31 Jul 2019

👍2

It would be really awesome to see this appear somewhere soon. There are 3rd party solutions available (e.g cfn-saml-provider but the best would be a native cfn integration.

tuxinaut on 15 Aug 2019

👍2

Hi,

now that CFormation integrates with AWS Organizations (https://aws.amazon.com/blogs/aws/new-use-aws-cloudformation-stacksets-for-multiple-accounts-in-an-aws-organization/) and we can have new accounts getting configured with cloudformation on adding to organizations I would love to see SAMLProvider added so i can have saml federated access automatically set on account creation too

kind regards

seb-steuer on 12 Feb 2020

Recently read an article on the blog suggesting a workaround with Lambda. Workarounds are fine and I understand that these things take time, but let's call it what it is: a temporary workaround to provide some relief to gaps in the product.

As a user, the most frustrating view of custom resources for AWS resources is this: if I as a user can write a working custom resource, how much harder could it be for the AWS teams to add it natively? I fully respect the service teams and that I am ignorant to "how the sausage is made". It would just be nice to have _some_ acknowledgement of this request from the service teams considering it is in the top-ten most popular requests on this road map.