{"id":21812772,"url":"https://github.com/mozilla-iam/federated-aws-rp","last_synced_at":"2025-07-20T08:30:57.057Z","repository":{"id":47810217,"uuid":"219066150","full_name":"mozilla-iam/federated-aws-rp","owner":"mozilla-iam","description":"Federated AWS RP is an AWS API Gateway and Lambda OpenID Connect (OIDC) Relying Party (RP) to allow users to log into the AWS Management Console with their federated identity using Single Sign On.","archived":false,"fork":false,"pushed_at":"2021-08-12T21:06:29.000Z","size":421,"stargazers_count":3,"open_issues_count":12,"forks_count":3,"subscribers_count":12,"default_branch":"master","last_synced_at":"2023-08-06T14:11:18.106Z","etag":null,"topics":["aws","openid-connect","sso"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mozilla-iam.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-11-01T21:36:07.000Z","updated_at":"2023-08-06T14:11:18.107Z","dependencies_parsed_at":"2022-09-09T18:54:33.917Z","dependency_job_id":null,"html_url":"https://github.com/mozilla-iam/federated-aws-rp","commit_stats":null,"previous_names":[],"tags_count":5,"template":null,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla-iam%2Ffederated-aws-rp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla-iam%2Ffederated-aws-rp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla-iam%2Ffederated-aws-rp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla-iam%2Ffederated-aws-rp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mozilla-iam","download_url":"https://codeload.github.com/mozilla-iam/federated-aws-rp/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":226761304,"owners_count":17677743,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","openid-connect","sso"],"created_at":"2024-11-27T14:19:51.961Z","updated_at":"2024-11-27T14:19:52.690Z","avatar_url":"https://github.com/mozilla-iam.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Federated AWS RP\n\nFederated AWS RP is an AWS API Gateway and Lambda OpenID Connect (OIDC) Relying \nParty (RP) to allow users to log into the AWS Management Console with their federated\nidentity using Single Sign On. This does not use [AWS SSO](https://aws.amazon.com/single-sign-on/)\nwhich only works with Active Directory or SAML identity providers, and instead\nuses [AWS identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers.html)\nwith OIDC.\n\nFederated AWS RP is the sister project to [Mozilla AWS CLI](https://github.com/mozilla-iam/mozilla-aws-cli).\nFederated AWS RP enables login to the AWS Management Console, where Mozilla AWS CLI\nenables command line and API access to AWS.\n\nThe Federated AWS RP is a serverless service hosted via AWS API Gateway backed\nby AWS Lambda. The backend API is designed to interact with the frontend in the\nexact same way as the backend for the [Mozilla AWS CLI](https://github.com/mozilla-iam/mozilla-aws-cli)\nso that both tools use the same frontend code and have the same UI.\n\n* AWS Federated Login Website frontend code : https://github.com/mozilla-iam/federated-aws-rp/tree/master/functions/federated_aws_rp/static\n* Mozilla AWS CLI frontend code : https://github.com/mozilla-iam/mozilla-aws-cli/tree/master/mozilla_aws_cli/static\n\nThe Federated AWS RP website\n\n* authenticates the user using SSO\n* using the ID token received during SSO, fetches a list of AWS IAM Roles the user can assume\n* presents an IAM Role picker to the user\n* authenticates to AWS using the ID Token, assuming the selected IAM Role\n* redirects the user to the AWS Management Console, now authenticated as the selected IAM Role\n\nThe Federated AWS RP depends on\n* The [Group Role Map Builder](https://github.com/mozilla-iam/mozilla-aws-cli/tree/master/cloudformation)\n  being deployed\n* The [ID Token for Roles API](https://github.com/mozilla-iam/mozilla-aws-cli/tree/master/cloudformation)\n  being deployed\n* Being deployed in the `us-east-1` region as [that's the only region that supports\n  https on the `/` endpoint](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html#https-requirements-aws-region)\n* A pre-existing Route53 DNS name to use for the site and an associated pre-existing\n  ACM certificate\n* The identity provider passing the user's groups in the `amr` field of the ID\n  Token. At Mozilla, we filter users' group lists passed in the `amr` field to\n  workaround a limit in the size of the ID token passed to AWS using [a custom\n  Auth0 rule](https://github.com/mozilla-iam/auth0-deploy/blob/master/rules/AWS-Federated-AMR.js)\n\nMore information can be found in the [Mozilla AWS CLI README](https://github.com/mozilla-iam/mozilla-aws-cli/blob/master/README.md).\n\nAt Mozilla this service is hosted at https://aws.sso.mozilla.com/ . More internal\nMozilla information can be found [in our internal documentation](https://mana.mozilla.org/wiki/display/SECURITY/AWS+Federated+Login+with+Single+Sign+On).\n\n# Deploying\n\nRun `make deploy-aws-federated-rp` to package up the [functions](https://github.com/mozilla-iam/federated-aws-rp/tree/master/functions/federated_aws_rp)\nand the [CloudFormation template](https://github.com/mozilla-iam/federated-aws-rp/blob/master/federated-aws-rp.yaml)\nand deploy the stack into AWS using CloudFormation\n\n# Mozilla's Deployment\n\nThe dev instance of the Federated AWS RP is deployed in the `infosec-dev` AWS\naccount in `us-east-1` in the `FederatedAWSRP` CloudFormation stack and can\nbe accessed at https://aws.security.allizom.org/ . This dev instance talks to\nthe production Auth0 identity provider\n\nThe prod instance is deployed in the `mozilla-iam` AWS account in `us-east-1` in\nthe `FederatedAWSRP` CloudFormation stack and can be accessed at https://aws.sso.mozilla.com/","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmozilla-iam%2Ffederated-aws-rp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmozilla-iam%2Ffederated-aws-rp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmozilla-iam%2Ffederated-aws-rp/lists"}