Configure your SAML 2.0 IdP with relying party trust and adding claims

When you create an IAM identity provider and role for SAML access, you are telling Amazon about the external identity provider (IdP) and what its users are allowed to do. Your next step is to then tell the IdP about Amazon as a service provider. This is called adding relying party trust between your IdP and Amazon. The exact process for adding relying party trust depends on what IdP you're using. For details, see the documentation for your identity management software.

Many IdPs allow you to specify a URL from which the IdP can read an XML document that contains relying party information and certificates. For Amazon, use https://region-code.signin.amazonaws.cn/static/saml-metadata.xml or https://signin.amazonaws.cn/static/saml-metadata.xml. For a list of possible region-code values, see the Region column in Amazon Sign-In endpoints.

If you can't specify a URL directly, then download the XML document from the preceding URL and import it into your IdP software.

You also need to create appropriate claim rules in your IdP that specify Amazon as a relying party. When the IdP sends a SAML response to the Amazon endpoint, it includes a SAML assertion that contains one or more claims. A claim is information about the user and its groups. A claim rule maps that information into SAML attributes. This lets you make sure that SAML authentication responses from your IdP contain the necessary attributes that Amazon uses in IAM policies to check permissions for federated users. For more information, see the following topics: