ReleaseBytes
aws Modernizing with AWS Blog ·

Integrate Amazon Connect with AWS Managed AD via IAM Identity Center

blogsecurityinfraawsengineeraws-iam
announcement

This post details how to integrate Amazon Connect with AWS Managed Microsoft Active Directory (AD) using IAM Identity Center (formerly AWS SSO) and SAML-based authentication. This solution addresses the common challenge of using existing AD infrastructure for contact center authentication across multiple AWS accounts, especially when the Amazon Connect instance and AWS Managed AD reside in different accounts. The approach leverages organization-level IAM Identity Center with delegated administration to provide centralized user management and secure authentication.

  • →Solution Overview
  • →Requirement for Organization-Level IAM Identity Center
  • →Delegated Administration for Multi-Account Setups
  • →Prerequisites for Integration
  • →Phased Walkthrough
Notes (6) ›
  • Solution Overview

    The solution architecture configures organization-level IAM Identity Center with delegated administration for cross-account integration between Amazon Connect and AWS Managed Microsoft AD. The authentication flow involves accessing the IAM Identity Center portal, credential validation against AWS Managed AD via LDAP, SAML assertion generation, and AWS Sign-In processing to assume an IAM role in the Connect account for federated access.

  • Requirement for Organization-Level IAM Identity Center

    Amazon Connect, being an AWS managed application, exclusively works with organization-level IAM Identity Center instances, not account-level ones. This post emphasizes this prerequisite for successful integration.

  • Delegated Administration for Multi-Account Setups

    When AWS Managed Microsoft AD is in a member account, delegated administration must be configured to allow that member account to manage the identity source configuration within IAM Identity Center.

  • Prerequisites for Integration

    Before implementation, users need AWS Organizations enabled, AWS Managed Microsoft AD deployed in a member account, user email addresses configured in AD, necessary IAM permissions, and the Amazon Connect instance access URL. Existing account-level IAM Identity Center instances in member accounts must be removed.

  • Phased Walkthrough

    The post guides users through four phases: configuring organization-level IAM Identity Center with delegated administration, setting up Active Directory as the identity source with synchronization, creating an Amazon Connect instance with SAML authentication, and configuring the Amazon Connect application within IAM Identity Center.

  • User Email Address Requirement

    All users in AWS Managed Microsoft AD must have email addresses configured, as the Amazon Connect application requires this information for successful authentication.

Read the original announcement →

https://aws.amazon.com/blogs/modernizing-with-aws/integrate-amazon-connect-with-aws-managed-ad-via-iam-identity-center/

Related releases