Giving Federated Users Direct Access to the AWS Management Console

This topic describes how to construct a URL that gives your federated users direct access to the AWS Management Console. This task uses the AWS Identity and Access Management (IAM) and AWS Security Token Service (STS) HTTPS Query APIs. For more information about making Query requests, go to Making Query Requests in Using IAM.

This topic describes how to programmatically construct a URL that gives your federated users direct access to the AWS Management Console. The following code snippet uses the AWS SDK for Java. You replace the red text with the appropriate values for your use case.

import java.net.URLEncoder;
import java.net.URL;
import java.net.URLConnection;
import java.io.BufferedReader;
import java.io.InputStreamReader;
// Available at http://www.json.org/java/index.html
import org.json.JSONObject;
import com.amazonaws.auth.AWSCredentials;
import com.amazonaws.auth.BasicAWSCredentials;
import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient;
import com.amazonaws.services.securitytoken.model.Credentials;
import com.amazonaws.services.securitytoken.model.GetFederationTokenRequest;
import com.amazonaws.services.securitytoken.model.GetFederationTokenResult;

AWSCredentials credentials = new BasicAWSCredentials(
  "*** Access Key ID ***",
  "*** Secret Key ***");
AWSSecurityTokenServiceClient stsClient = 
  new AWSSecurityTokenServiceClient(credentials);

GetFederationTokenRequest getFederationTokenRequest = 
  new GetFederationTokenRequest();
getFederationTokenRequest.setDurationSeconds(3600);
getFederationTokenRequest.setName("UserName");

// A sample policy for accessing Amazon SNS in the console.
String policy = "{\"Statement\":[{\"Action\":\"sns:*\"," +
  "\"Effect\":\"Allow\",\"Resource\":\"*\"}]}";

getFederationTokenRequest.setPolicy(policy);

GetFederationTokenResult federationTokenResult = 
  stsClient.getFederationToken(getFederationTokenRequest);

Credentials federatedCredentials = federationTokenResult.getCredentials();

// The issuer parameter specifies your internal sign-in
// page, for example https://mysignin.internal.mycompany.com/.
// The console parameter specifies the URL to the destination console of the
// AWS Management Console. This example goes to the Amazon SNS console.
// The signin parameter is the URL to send the request to.
String issuerURL = "https://mysignin.internal.mycompany.com/";
String consoleURL = "https://console.aws.amazon.com/sns";
String signInURL = "https://signin.aws.amazon.com/federation";
  
// Create the sign-in token using temporary credentials,
// including the Access Key ID,  Secret Access Key, and security token.
String sessionJson = String.format(
  "{\"%1$s\":\"%2$s\",\"%3$s\":\"%4$s\",\"%5$s\":\"%6$s\"}",
  "sessionId", federatedCredentials.getAccessKeyId(),
  "sessionKey", federatedCredentials.getSecretAccessKey(),
  "sessionToken", federatedCredentials.getSessionToken());
              
String getSigninTokenURL = signInURL + "?Action=getSigninToken" +
  "&SessionType=json&Session=" + URLEncoder.encode(sessionJson,
  "UTF-8");
URL url = new URL(getSigninTokenURL);
URLConnection conn = url.openConnection ();
BufferedReader bufferReader = new BufferedReader(new 
  InputStreamReader(conn.getInputStream()));  
String returnContent = bufferReader.readLine();
String signinToken = new JSONObject(returnContent).getString("SigninToken");

String signinTokenParameter = "&SigninToken=" + 
  URLEncoder.encode(signinToken,"UTF-8");

// The issuer parameter is optional, but recommended. Use it to direct users
// to your sign-in page when their session expires.
String issuerParameter = "&Issuer=" + URLEncoder.encode(issuerURL, "UTF-8");
String destinationParameter = "&Destination=" + 
  URLEncoder.encode(consoleURL,"UTF-8");
String loginURL = signInURL + "?Action=login" + signinTokenParameter + 
  issuerParameter + destinationParameter;

This topic describes how to programmatically construct a URL that gives your federated users direct access to the AWS Management Console. This code snippet uses the AWS SDK for Ruby.

require 'rubygems'
require 'json'
require 'open-uri'
require 'cgi'
require 'aws-sdk'

# Normally, the temporary credentials will come from your identity
# broker, but for this example we create them here
sts = AWS::STS.new(:access_key_id => "*** Your AWS Access Key ID ***",
  :secret_access_key => "*** Your AWS Secret Access Key ***")

# A sample policy for accessing Amazon SNS in the console.
policy = AWS::STS::Policy.new
policy.allow(:actions => "sns:*",:resources => :any)

session = sts.new_federated_session(
  "UserName",
  :policy => policy,
  :duration => 3600)

# The issuer parameter specifies your internal sign-in
# page, for example https://mysignin.internal.mycompany.com/.
# The console parameter specifies the URL to the destination console of the
# AWS Management Console. This example goes to the Amazon SNS console.
# The signin parameter is the URL to send the request to.
issuer_url = "https://mysignin.internal.mycompany.com/"
console_url = "https://console.aws.amazon.com/sns"
signin_url = "https://signin.aws.amazon.com/federation"

# Create the sign-in token using temporary credentials,
# including the Access Key ID, Secret Access Key, and security token.
session_json = {
  :sessionId => session.credentials[:access_key_id],
  :sessionKey => session.credentials[:secret_access_key],
  :sessionToken => session.credentials[:session_token]
}.to_json

get_signin_token_url = signin_url + "?Action=getSigninToken" + 
  "&SessionType=json&Session=" + CGI.escape(session_json)
returned_content = URI.parse(get_signin_token_url).read
signin_token = JSON.parse(returned_content)['SigninToken']
signin_token_param = "&SigninToken=" + CGI.escape(signin_token)

# The issuer parameter is optional, but recommended. Use it to direct users
# to your sign-in page when their session expires.
issuer_param = "&Issuer=" + CGI.escape(issuer_url)
destination_param = "&Destination=" + CGI.escape(console_url)

login_url = signin_url + "?Action=login" + signin_token_param + 
  issuer_param + destination_param