Technical Guide
Integrating AWS SSO with Azure AD Using Terraform: A Complete Guide to Role-Based Access
In modern cloud environments, identity and access management plays a critical role in security, governance, and user experience. Organizations using Microsoft 365 or Azure services often rely on Azure Active Directory (Azure AD) as their central identity provider. On the AWS side, AWS IAM Identity Center (formerly AWS SSO) provides seamless single sign-on for accessing multiple AWS accounts.
What We Will Explore
- What AWS SSO / IAM Identity Center is
- How Azure AD works with AWS for authentication
- How permission sets in AWS define user access
- How to automate the entire process using Terraform
- How to assign specific permissions to users or groups through SSO roles
What is AWS SSO (IAM Identity Center)?
AWS IAM Identity Center is a service that enables:
- Single Sign-On (SSO) across AWS Organizations
- Centralized identity management
- Role-based access control using Permission Sets
- Integration with external identity providers (Azure AD, Okta, Google Workspace)
It eliminates the need to create IAM users in multiple AWS accounts and simplifies access management.
Why Integrate AWS SSO with Azure AD?
Most enterprises already rely on Azure AD for user identity management, device compliance, MFA (multi-factor authentication), and Conditional Access Policies. By integrating Azure AD with AWS SSO:
- Users authenticate using Azure AD
- Groups from Azure AD are mapped to AWS Permission Sets
- Access provisioning becomes automated
- Users enjoy passwordless / seamless login experience
Architecture Overview
- Azure AD is configured as an External Identity Provider (IdP) using SAML or OIDC.
- AWS SSO IAM Identity Center trusts Azure AD for authentication.
- Azure AD groups map to AWS Permission Sets.
- Permission Sets translate to IAM roles in AWS accounts.
- Terraform automates all configuration: Permission Set creation, Account assignments, and SSO role policies.
Architecture Overview
Diagram: End-to-end authentication and automation flow via Terraform
Key Components in AWS IAM Identity Center
1. Identity Source
Set to External Identity Provider (Azure AD) to delegate authentication management.
2. Permission Sets
Templates converted into IAM roles inside AWS accounts. Can contain AWS managed policies, inline policies, or customer managed policies (e.g., ReadOnlyAccess, AdminAccess, DeveloperAccess, BillingAccess).
3. Assignments
These connect a specific User or Group to a Permission Set within a specific AWS Account.
End-to-End Flow
- User logs in using Microsoft credentials
- Azure AD authenticates the user
- AWS SSO validates the token
- User lands in the AWS SSO dashboard
- User clicks on an AWS account’s role
- Assumed role generates temporary credentials
Terraform Automation for AWS SSO + Azure AD
Terraform helps you define access once, apply it consistently across all accounts, and avoid manual console-based misconfigurations.
1. Create a Permission Set
resource "aws_ssoadmin_permission_set" "developer_access" {
name = "DeveloperAccess"
instance_arn = var.sso_instance_arn
description = "Developer level access using SSO"
session_duration = "PT8H"
tags = {
environment = "prod"
}
}2. Attach Policies (AWS Managed + Inline)
# Managed Policy Attachment
resource "aws_ssoadmin_managed_policy_attachment" "developer_policy" {
instance_arn = var.sso_instance_arn
permission_set_arn = aws_ssoadmin_permission_set.developer_access.arn
managed_policy_arn = "arn:aws:iam::aws:policy/PowerUserAccess"
}
# Inline policy example (restricting S3 + DynamoDB)
resource "aws_ssoadmin_permission_set_inline_policy" "developer_inline" {
instance_arn = var.sso_instance_arn
permission_set_arn = aws_ssoadmin_permission_set.developer_access.arn
inline_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Action = ["s3:*", "dynamodb:*"]
Resource = "*"
}
]
})
}3. Azure AD Group to AWS Account Assignment
resource "aws_ssoadmin_account_assignment" "developer_assignment" {
instance_arn = var.sso_instance_arn
permission_set_arn = aws_ssoadmin_permission_set.developer_access.arn
principal_type = "GROUP"
principal_id = var.azure_ad_group_id # This comes from Azure AD (SCIM)
target_id = var.aws_account_id
target_type = "AWS_ACCOUNT"
}
# Variables Example
variable "sso_instance_arn" {}
variable "azure_ad_group_id" {}
variable "aws_account_id" {}Conclusion
Integrating AWS IAM Identity Center with Azure AD provides a secure, scalable, and user-friendly identity solution. By using Terraform to automate SSO permission sets and assignments, enterprises can ensure faster onboarding, zero console-based manual errors, consistent permission models across accounts, and compliance and audit readiness. This approach is especially valuable for organizations operating multiple AWS accounts under AWS Organizations.