Configure AWS SSO with Access for SaaS

This guide covers how to configure AWS SSO with Access for SaaS. Cloudflare Access for SaaS allows you to layer additional network and device posture policies on top of existing identity authentication from your identity provider. In this example, we are using Okta as an identity provider, but any supported identity provider can be leveraged.

​​ Prerequisites

• A Zero Trust account
• An integrated IdP
• Admin access to an AWS account

​​ 1. Configure AWS

1. In the AWS admin panel, search for SSO.

2. Add AWS Single Sign on to your AWS account.

3. Select Choose an identity source.

4. Change the identity source to External Identity provider.

5. Select Show individual metadata values. These will be the fields that are added to the Cloudflare Access for SaaS app.

6. Copy the AWS SSO ACS URL.

​​ 2. Configure Cloudflare

1. In a separate tab or window, open Zero Trust Open external link and go to Access > Applications.

2. Select SaaS as the application type to begin creating a SaaS application.

3. Copy the following fields from your AWS account and input them in the Zero Trust application configuration:

   AWS value	Cloudflare value
   AWS SSO ACS URL	Assertion Consumer Service URL
   AWS SSO Issuer URL	Entity ID

   The Name ID Format must be set to: Email.

4. (Optional) Additional Attribute Statements can be passed from your IdP to AWS SSO. More information about AWS Attribute mapping can be found at Attribute mappings - AWS Single Sign-On Open external link .

5. Copy the Cloudflare IdP metadata values and save them for the Final AWS configuration.

6. Select Next.

7. Now create an Access policy to determine who has access to your application.

8. Save your policy and return to the AWS SSO dashboard.

​​ 3. Complete the AWS configuration

1. Paste the Cloudflare IdP metadata into your AWS account with these mappings:

   Cloudflare value	AWS value
   SSO Endpoint	IdP Sign-in URL
   Access Entity ID	IdP Issuer URL
   Public Key	IdP Certificate

2. Select Next: Review.

3. Set Provisioning to Manual.

​​ Test your connection

User should now be able to successfully log in. To test your connection, open the user portal URL.