Note: Advance configuration on the AWS side is required.
Note: In July 2022, AWS IAM Identity Center was renamed from AWS Single Sign-On. The configuration steps are almost unchanged, but please note that the names and screenshots in this manual are from AWS SSO, so the actual screens may differ.
Note: For the latest configuration steps, please refer to the manual provided by Amazon.

TrustLogin Admin Page Settings

1. Log in to TrustLogin, open the "Admin Page > Apps" menu, and click the "Register App" button in the upper right of the screen.
   
   
   
2. Search on the "Register Corporate App" screen and select "AWS Single Sign-On (SAML)."
   
   
   
3. Download the metadata from "Download Metadata" under "Identity Provider Information."
   

Now, let's move on to the settings on the AWS side.
Without clicking the "Register" button, open the AWS Single Sign-On Console in a separate tab.

AWS Settings

1. AWS Single Sign-On Console and sign in.
   
   

2. Select "Enable AWS SSO." Note: This can only be enabled by a root account.
   
   
   

3. Confirm that it has been enabled successfully.
   
   
   

4. From "Settings," select "Actions > Change identity source."
   
   
   

5. Select "External ID provider."
   
   
   

6. Download the metadata from "Download metadata file" under "Service provider metadata." You will upload this downloaded metadata file to TrustLogin later.
   
   
   

7. Upload the metadata you downloaded from TrustLogin to "IdP SAML metadata," then click "Next."

   
   
   

8. Enter "Accept" and select "Change identity source."
   
   
   

9. Confirm that the message is displayed.
   

Return to the TrustLogin Admin Page again.

TrustLogin Admin Page Settings (Continued)

1. Upload the metadata file obtained from AWS via "Select Metadata" on the app registration screen.
   

2. Click the "Register" button to save.

TrustLogin User Settings

① When a user adds the app from My Page

1. Click the "Add App" button on "My Page."
2. On the "Register App" screen, select "AWS Single Sign-On (SAML)" and click the "Next" button in the upper right of the screen.
3. If you want to change the "Display Name," enter it, then click the "Register" button.

② When an administrator adds a member

1. Search for the "AWS Single Sign-On (SAML)" app in the "Admin Page > Apps" menu and click it.
2. Click "Add Member," select the user to add from the member list, and click the "Register" button to add them.

Adding a User in AWS

1. Register the user on the AWS side. Select "Add users" from "Users."
   
   
   

2. Enter the information for the user you registered to the app in TrustLogin, then click "Next."
   
   
   

3. Since no particular configuration is needed this time, simply select "Next" to proceed.
   
   
   

4. Click "Add user" and confirm that the user has been added successfully.
   
   
   
   

5. Open "Permission sets" and click "Create permission set."
   
   
   

6. Set the permission set type to "Predefined permission set," select "AdministratorAccess" from the list of AWS managed policies below, and proceed with "Next."
   
   
   

7. Set a permission set name of your choice and proceed with "Next."
   
   
   

8. Review the details and click "Create."
   
   
   

9. Confirm that the permission set has been created.
   
   
   

10. Open "AWS accounts" and click the account name link.
    
    
    

11. Select "Assign users or groups."
    
    
    

12. Check the box for the user you created earlier and click "Next."
    
    
    

13. Check the box for the permission set you created earlier and click "Next."
    
    
    

14. Review the details and click "Submit."
    

15. Confirm that the permission set has been applied to the account.
    

Verifying the Connection

1. Find the user portal URL from the AWS SSO dashboard and click it.
   
   
   

2. You will be redirected to the TrustLogin sign-in page, so log in there.
   
   
   

3. You will be redirected to the AWS screen.
   
   
   

4. Click "AWS Account" to display the account name, and expand it further to display the assigned permission set. Select "Management Console" to its right.
   
   
   

5. The AWS Management Console will be displayed.