SSO Application (Legacy Guide)

Last Updated

January 2024

Authors

• Veaceslav Mindru, Sr. Technical Account Manager, AWS

• Stephanie Gooch, Sr. Commercial Architect, AWS OPTICS

Introduction

Cloud Intelligence Dashboards (CID) helps you to visualize and understand AWS cost and usage data in your organization by exploring interactive dashboards. To simplify access for users you can now set up an SSO application for them to enter into. We recommend combining this with the Row Level Security customization to ensure they see the data they really matters to them.

Important

This is a legacy guide, for a new fresh setup of QuickSight we recomend to setup QuickSight with IAM Identity Center integration. Please follow Publishing as single sign-on (SSO) Application guide

Prerequisite

For this solution you must have the following:

• Access to your AWS Organizations and ability to tag resources

• An AWS Cost and Usage Reports (CUR) or if from the multiple payers these must be replicated into a bucket, more info here

• A CID deployed over this CUR data, checkout the new single deployment method here.

• A list of users and what level of access they require. This can be member accounts, organizational units (OU) or payers.

• Enable IAM Identity Center

Step 1: Quicksight Check

1. Login into your Cost Account where your CID is deployed and go into Amazon QuickSight

2. Select your CID and open it

3. On the top right click on the Share icon then Share Dashboard

4. Share your CID Dashboard in Amazon QuickSight with all users by clicking on the toggle Everyone in this account

5. Copy the Dashboard URL to somewhere local as we will use this later

Step 2: Create Users and Group

1. Open the IAM Identity Centre. Click on Groups on the left then Create group

2. Under Group name, give the name CID then click Create group

3. Click on Users then Add user

4. Fill out the details using the same email that will be used for Amazon QuickSight. Click Next.

5. Click on the box next to the CID group you made earlier. Then Click Next.

6. Scroll down and click Add user

Step 3: IAM Identity Centre

1. Open the IAM Identity Centre and select Applications on the left and Click Add application

2. Search in Preintegrated applications for Amazon Quicksight then click Next

3. Type a Display name Billing Dashboard. Under IAM Identity Center metadata Download IAM Identity Center SAML metadata file.

4. Under Application properties paste your CID Link under Relay state. Click Submit

5. Click into your application and slick Assign Users

6. Click on the Groups tab and select the CID group then click the Assign Users button

Step 4: Provider

Note: This step is done in the target account where the CID lives, this may differ from the SSO account.

1. Open IAM, on the left click Identity providers then click the Add provider button

2. Under Provider type choose SAML, give it the name QuickSightProvider then upload the SAML file you downloaded earlier using the Choose file button. Click Add provider

3. Click into your new provider

4. Click the button Assign role and choose Create a new role and click Next

5. Ensure SAML 2.0 federation is clicked at the top then click the Allow programmatic and AWS Management Console access radio button and click Next: Permissions

6. Click Create policy

7. Select the JSON tab and paste in the below code replacing your ACCOUNT_ID with your CID Quicksight account ID. Click Next.

            {
               "Statement": [
                    {
                    "Action": [
                            "quicksight:CreateReader"
                    ],
                    "Effect": "Allow",
                    "Resource": [
                            "*"
                    ]
                    }
            ],
            "Version": "2012-10-17"&TCX5-2025-waiver;
            }

8. Click through Next

9. For Name call it QuickSightSAMLPolicy then click Create Policy

10. Go back to previous IAM tab to attach permissions, refresh the list then search for QuickSightSAMLPolicy and click the tick box. Click Next

11. Provide a Role name as QuickSightSAMLRole and click Create role

12. Search for your new role and click into it. Select the Trust relationships tab and click Edit trust policy

13. Replace the json with the below, replacing your ACCOUNT_ID with your CID Quicksight account ID.

            {
            "Version": "2012-10-17",&TCX5-2025-waiver;
            "Statement": [
                    {
                    "Effect": "Allow",
                    "Principal": {
                            "Federated": "arn:aws:iam::ACCOUNT_ID:saml-provider/QuickSightProvider"
                    },
                    "Action": "sts:AssumeRoleWithSAML",
                    "Condition": {
                            "StringEquals": {
                            "SAML:aud": "https://signin.aws.amazon.com/saml"
                            }
                    }
                    },
                    {
                    "Effect": "Allow",
                    "Principal": {
                            "Federated": "arn:aws:iam::ACCOUNT_ID:saml-provider/QuickSightProvider"
                    },
                    "Action": "sts:TagSession",
                    "Condition": {
                            "StringLike": {
                            "aws:RequestTag/Email": "*"
                            }
                    }
                    }
    
            ]
            }

Update Attribute Mappings

1. Return to your IAM Identity Center and find your Amazon Quicksight application for CID and click into it.

2. Click the Actions button and select Edit attribute mapping

3. Add two new mappings by clicking on Add new attribute mapping, replacing your ACCOUNT_ID with your CID Quicksight account ID.

   • ADD Attribute: https://aws.amazon.com/SAML/Attributes/Role Value: arn:aws:iam::111122223333:role/QuickSightSAMLRole, arn:aws:iam::111122223333:saml-provider/QuickSightProvider

   • ADD: Attribute: https://aws.amazon.com/SAML/Attributes/PrincipalTag:Email Value ${user:email}

4. After this step is done, a new ICON will appear in SSO, give it 5 minutes to start