Prevent untrusted OIDC Provider for SAML API

[agnel123]

This code will prevent issusing sts tokens with AssumeRoleWithSAML if the request context does not contain SAML: aud with trusted identity providers.

{
            "Sid": "EnforceTrustedOIDCProvidersSAML",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "sts:AssumeRoleWithSAML",
            "Resource": "*",
            "Condition": {
                "StringNotEqualsIfExists": {
                    "SAML:aud": "https://signin.aws.amazon.com/saml",
                    "<SAML1:aud>": "audience name1",
                    "<SAML2:aud>": "audience name2"
                }
            }
}

[liwadman]

Thank you for opening an issue. Could you expand upon what you mean a bit more?

[agnel123]

When an identity center is configured to issue tokens, it will be used as mechanism to login to different aws account in specific organization. Identity center will use sts:AssumeRolewithSAML API to issue tokens with destination role in another aws account which contain SAML:aud": "https://signin.aws.amazon.com/saml in the request context. Now, we want to prevent all other request that tries to assume the role and issue the tokens for the destination to login. It will prevent all API Action sts:AssumeRoleWithSAML if request context does not "SAML:aud": "https://signin.aws.amazon.com/saml". We need to include only the trusted SAML:AUD which we trust in the organization.

[liwadman]

The saml:aud condition key is populated from the 'recipient' value in the subjectconfirmationdata element of a SAML assertion. This is in the IAM SAML documentation: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml_assertions.html

Which is to say that anyone in control of a SAML IDP can populate that value, and it cannot be trusted to identify AWS, or any other party. What the intended usage of that field is for a SAML SP to be able to tell if it is the intended recipient of a SAML assertion.

[agnel123]

I see. What do you recommend to protect sts: AssumeRoleWithSAML API Action similar to sts: AssumeRoleWithWebIdentity?

[liwadman]

I think it depends on the outcome you're trying to achieve. Can you provide more information on the problem you're trying to solve?

If this is security sensitive, you may also ask your account to setup a meeting and we can discuss further under NDA.

Thanks,

Liam