ECS 3.6.2 Data Access Guide

ECS IAM SAML support

Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider (IdP) and a service provider.

ECS supports integration with SAML 2.0 compliant Identity Providers (IdPs). The IdP must be able to generate SAML 2.0 Assertions with the following:

• The referral must be SAML 2.0 compliant as set out in https://datatracker.ietf.org/doc/html/rfc7522.
• The following claim attributes must be mapped in the IdP generated SAML assertion:
  • NameId: Must be formatted as a username.
  • RoleSessionName: The https://aws.amazon.com/SAML/Attributes/RoleSessionName must be mapped to the email address of the user. Example: bloke@dell.com.
  • Roles: The https://aws.amazon.com/SAML/Attributes/Role must be mapped to the SAML Provider URN, Role URN. Example: urn:ecs:iam::s3:saml-provider/provider1,urn:ecs:iam::s3:role/SAML-RW-Access.