Gaining federated access to the AWS Management Console

For this example, let's say we are using MS-AD. We may have tens or even hundreds of users who may need access to our AWS resources via the Management Console, but instead of creating AWS user accounts for each and every user, we can set up IAM federation using IAM roles and SAML. MS-AD is a SAML 2.0-compliant IdP, and using IAM roles you can allow the IdP to grant MS-AD identities access and permissions to access the AWS Management Console to perform tasks and actions.

To begin with, you need to configure your enterprise network as a SAML provider to AWS. As a part of this configuration, you will need to do the following:

1. Configure MS-AD to work with a SAML IdP, for example, Windows Active Directory Domain Services.
2. You must then create a metadata.xml document via your IdP, which is a key document in the configuration. This metadata.xml document also includes authentication keys.
3. Using your organization's portal, you must...