AWS as a SAML IDP

To use AWS as a SAML IDP, you must add Lacework as a custom application to AWS SSO:

1. Log in to the AWS Management Console with your AWS Organization’s administrator account credentials.
2. Open the AWS SSO console.
3. Choose Enable AWS SSO.
4. If you haven’t already set up AWS Organizations, you will need to create an organization. Click Create AWS Organization to do so. If you have already set up AWS Organizations, move on to the next step.
5. Click Applications in the AWS SSO console’s left navigation pane.
6. Click Add a new application.
7. In the Select an application box, select Custom SAML 2.0 application.

8. Choose Configure application.
9. On the Configure <Custom app name> page, under Details, enter Lacework as the Display name for the application.
10. Under AWS SSO metadata, next to AWS SSO SAML metadatafile, choose Download to download the identity provider metadata, which will eventually be uploaded to the Lacework Console.

11. Under Application metadata, choose to type metadata manually and provide the Application ACS URL and Application SAML audience values as shown below:

• Application ACS URL: https://youraccount.lacework.net/sso/saml/login
• Application SAML audience: https://lacework.net

12. Save the application.
13. Once saved, navigate to the Attribute mappings tab and update the attribute mappings with your user email. The only user attribute required is the user email (first row). The additional attributes are not required unless JIT user provisioning is enabled.

14. Navigate to the Lacework Console.
15. Enable SAML in the Lacework Console.
16. Upload the AWS SSO metadata that you downloaded in Step 10.
17. To enable JIT user provisioning, see Okta SAML JIT.
18. Now, you can successfully log in to the Lacework Console using SAML.