saml_providers

Creates, updates, deletes, gets or lists a saml_providers resource.

Overview

Name	saml_providers
Type	Resource
Id	aws.iam.saml_providers

Fields

The following fields are returned by SELECT queries:

get_saml_provider

Name	Datatype	Description
assertion_encryption_mode	string	Specifies the encryption setting for the SAML provider.
create_date	string	The date and time when the SAML provider was created.
private_key_list	string	The private key metadata for the SAML provider.
saml_metadata_document	string	The XML metadata document that includes information about an identity provider.
saml_provider_uuid	string	The unique identifier assigned to the SAML provider.
tags	string	A list of tags that are attached to the specified IAM SAML provider. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
valid_until	string	The expiration date and time for the SAML provider.

list_saml_providers

Name	Datatype	Description
arn	string	The Amazon Resource Name (ARN) of the SAML provider.
create_date	string	The date and time when the SAML provider was created.
valid_until	string	The expiration date and time for the SAML provider.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_saml_provider	select	SAMLProviderArn, region		Returns the SAML provider metadocument that was uploaded when the IAM SAML provider resource object was created or updated. This operation requires Signature Version 4.
list_saml_providers	select	region		Lists the SAML provider resource objects defined in IAM in the account. IAM resource-listing operations return a subset of the available attributes for the resource. For example, this operation does not return tags, even though they are an attribute of the returned object. To view all of the information for a SAML provider, see GetSAMLProvider. This operation requires Signature Version 4.
create_saml_provider	insert	SAMLMetadataDocument, Name, region	Tags, AssertionEncryptionMode, AddPrivateKey	Creates an IAM resource that describes an identity provider (IdP) that supports SAML 2.0. The SAML provider resource that you create with this operation can be used as a principal in an IAM role's trust policy. Such a policy can enable federated users who sign in using the SAML IdP to assume the role. You can create an IAM role that supports Web-based single sign-on (SSO) to the Amazon Web Services Management Console or one that supports API access to Amazon Web Services. When you create the SAML provider resource, you upload a SAML metadata document that you get from your IdP. That document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that the IdP sends. You must generate the metadata document using the identity management software that is used as your organization's IdP. This operation requires Signature Version 4. For more information, see Enabling SAML 2.0 federated users to access the Amazon Web Services Management Console and About SAML 2.0-based federation in the IAM User Guide.
update_saml_provider	update	SAMLProviderArn, region	SAMLMetadataDocument, AssertionEncryptionMode, AddPrivateKey, RemovePrivateKey	Updates the metadata document, SAML encryption settings, and private keys for an existing SAML provider. To rotate private keys, add your new private key and then remove the old key in a separate request.
delete_saml_provider	delete	SAMLProviderArn, region		Deletes a SAML provider resource in IAM. Deleting the provider resource from IAM does not update any roles that reference the SAML provider resource's ARN as a principal in their trust policies. Any attempt to assume a role that references a non-existent provider resource ARN fails. This operation requires Signature Version 4.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
Name	string	The name of the provider to create. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
SAMLMetadataDocument	string	An XML document generated by an identity provider (IdP) that supports SAML 2.0. The document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that are received from the IdP. You must generate the metadata document using the identity management software that is used as your organization's IdP. For more information, see About SAML 2.0-based federation in the IAM User Guide
SAMLProviderArn	string	The Amazon Resource Name (ARN) of the SAML provider to delete.
region	string	AWS region (default: us-east-1)
AddPrivateKey	string	Specifies the new private key from your external identity provider. The private key must be a .pem file that uses AES-GCM or AES-CBC encryption algorithm to decrypt SAML assertions.
AssertionEncryptionMode	string	Specifies the encryption setting for the SAML provider.
RemovePrivateKey	string	The Key ID of the private key to remove.
SAMLMetadataDocument	string	An XML document generated by an identity provider (IdP) that supports SAML 2.0. The document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that are received from the IdP. You must generate the metadata document using the identity management software that is used as your IdP.
Tags	array	A list of tags that you want to attach to the new IAM SAML provider. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide. If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.

SELECT examples

get_saml_provider

Returns the SAML provider metadocument that was uploaded when the IAM SAML provider resource object was created or updated. This operation requires Signature Version 4.

SELECT
assertion_encryption_mode,
create_date,
private_key_list,
saml_metadata_document,
saml_provider_uuid,
tags,
valid_until
FROM aws.iam.saml_providers
WHERE SAMLProviderArn = '{{ SAMLProviderArn }}' -- required
AND region = '{{ region }}' -- required
;

list_saml_providers

Lists the SAML provider resource objects defined in IAM in the account. IAM resource-listing operations return a subset of the available attributes for the resource. For example, this operation does not return tags, even though they are an attribute of the returned object. To view all of the information for a SAML provider, see GetSAMLProvider. This operation requires Signature Version 4.

SELECT
arn,
create_date,
valid_until
FROM aws.iam.saml_providers
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_saml_provider

Creates an IAM resource that describes an identity provider (IdP) that supports SAML 2.0. The SAML provider resource that you create with this operation can be used as a principal in an IAM role's trust policy. Such a policy can enable federated users who sign in using the SAML IdP to assume the role. You can create an IAM role that supports Web-based single sign-on (SSO) to the Amazon Web Services Management Console or one that supports API access to Amazon Web Services. When you create the SAML provider resource, you upload a SAML metadata document that you get from your IdP. That document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that the IdP sends. You must generate the metadata document using the identity management software that is used as your organization's IdP. This operation requires Signature Version 4. For more information, see Enabling SAML 2.0 federated users to access the Amazon Web Services Management Console and About SAML 2.0-based federation in the IAM User Guide.

INSERT INTO aws.iam.saml_providers (
SAMLMetadataDocument,
Name,
region,
Tags,
AssertionEncryptionMode,
AddPrivateKey
)
SELECT 
'{{ SAMLMetadataDocument }}',
'{{ Name }}',
'{{ region }}',
'{{ Tags }}',
'{{ AssertionEncryptionMode }}',
'{{ AddPrivateKey }}'
RETURNING
saml_provider_arn,
tags
;

Manifest

# Description fields are for documentation purposes
- name: saml_providers
props:
  - name: SAMLMetadataDocument
    value: "{{ SAMLMetadataDocument }}"
    description: Required parameter for the saml_providers resource.
  - name: Name
    value: "{{ Name }}"
    description: Required parameter for the saml_providers resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the saml_providers resource.
  - name: Tags
    value: "{{ Tags }}"
    description: A list of tags that you want to attach to the new IAM SAML provider. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide. If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.
    description: A list of tags that you want to attach to the new IAM SAML provider. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide. If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.
  - name: AssertionEncryptionMode
    value: "{{ AssertionEncryptionMode }}"
    description: Specifies the encryption setting for the SAML provider.
    description: Specifies the encryption setting for the SAML provider.
  - name: AddPrivateKey
    value: "{{ AddPrivateKey }}"
    description: The private key generated from your external identity provider. The private key must be a .pem file that uses AES-GCM or AES-CBC encryption algorithm to decrypt SAML assertions.
    description: The private key generated from your external identity provider. The private key must be a .pem file that uses AES-GCM or AES-CBC encryption algorithm to decrypt SAML assertions.

UPDATE examples

update_saml_provider

Updates the metadata document, SAML encryption settings, and private keys for an existing SAML provider. To rotate private keys, add your new private key and then remove the old key in a separate request.

UPDATE aws.iam.saml_providers
SET 
-- No updatable properties
WHERE 
SAMLProviderArn = '{{ SAMLProviderArn }}' --required
AND region = '{{ region }}' --required
AND SAMLMetadataDocument = '{{ SAMLMetadataDocument}}'
AND AssertionEncryptionMode = '{{ AssertionEncryptionMode}}'
AND AddPrivateKey = '{{ AddPrivateKey}}'
AND RemovePrivateKey = '{{ RemovePrivateKey}}'
RETURNING
saml_provider_arn;

DELETE examples

delete_saml_provider

Deletes a SAML provider resource in IAM. Deleting the provider resource from IAM does not update any roles that reference the SAML provider resource's ARN as a principal in their trust policies. Any attempt to assume a role that references a non-existent provider resource ARN fails. This operation requires Signature Version 4.

DELETE FROM aws.iam.saml_providers
WHERE SAMLProviderArn = '{{ SAMLProviderArn }}' --required
AND region = '{{ region }}' --required
;