Introduction

To use Windows Active Directory (AD), Active Directory Federation Services (ADFS), and Security Assertion Markup Language 2.0 (SAML 2.0) to log in to the AWS Management Console, you can follow these general steps How to Use Windows Active Directory, ADFS, and SAML 2.0 to login AWS Console:

• Set up an ADFS server: Install and configure ADFS on a Windows server that is joined to your Active Directory domain. This server will act as the identity provider (IdP) in the SAML authentication flow.
• Configure AWS as a relying party trust: In the ADFS server, create a relying party trust for AWS. This trust establishes a relationship between the ADFS server and AWS, allowing the exchange of SAML assertions.
• Obtain the AWS metadata document: Download the AWS SAML metadata document from the AWS Management Console. This document contains the necessary configuration information for AWS.
• Configure claims rules: Set up claims rules in the ADFS server to map Active Directory attributes to the corresponding AWS SAML attributes. This step ensures that the necessary user information is included in the SAML assertion sent to AWS.
• Set up AWS IAM roles: Create IAM roles in AWS that define the permissions and access policies for users authenticated through SAML. These roles will determine the level of access users have in the AWS Management Console.
• Configure AWS IAM identity provider: Create an IAM identity provider in AWS and upload the ADFS metadata XML file. This step establishes the trust relationship between AWS and the ADFS server.
• Create an IAM role mapping: Create a role mapping in AWS that maps the SAML attributes received from ADFS to the corresponding IAM roles. This mapping determines which IAM role should be assumed based on the user’s attributes.
• Test the login process: Attempt to log in to the AWS Management Console using the ADFS server as the IdP. You should be redirected to the ADFS login page, and after successful authentication, you will be logged in to the AWS Management Console with the appropriate IAM role.

What is ADFS and SAML 2.0?

ADFS Overview

ADFS (Active Directory Federation Services) is a component of Windows Server that provides users with single sign-on access to systems and applications located across organizational boundaries.

SAML 2.0 Overview

SAML (Security Assertion Markup Language) 2.0 is an open standard for exchanging authentication and authorization data between identity providers (IdP) and service providers (SP).

When integrated, ADFS acts as the IdP and AWS acts as the SP, enabling users to log in to AWS using their Windows domain credentials.

Benefits of Using ADFS and SAML with AWS

• Centralized identity management using Active Directory.
• Improved security with token-based authentication.
• No need to manage IAM user passwords in AWS.
• Enhanced user experience through seamless SSO.
• Audit trail and compliance alignment with enterprise policies.

Using Windows Active Directory ADFS and SAML 2.0 to login AWS Console

Today, I tried the lab enabling federation to aws using windows active directory adfs and saml 2.0

I have a note for everyone: Use Windows Active Directory, ADFS, and SAML 2.0 to login AWS Console

• The Cloudformation template is an older version and some AMI IDs are older and cannot be used. In my case, I was using the Tokyo area, but I couldn’t use AMI and it crashed.
• Do not use Windows Server 2016 for your AD server. The “Configure AWS as a trusted relying party” step does not succeed and I am unable to log in to the AWS console afterward.
• Cloudformation template does not set up IIS, manual configuration, or create CERT yourself
• If you get an error when you visit the site https://localhost/adfs/ls/IdpInitiatedSignOn.aspx

An error occurred
The resource you are trying to access is not available. Contact your administrator for more information.

Change setting of EnableIdpInitiatedSignonPage property:Set-AdfsProperties – EnableIdpInitiatedSignonPage $True

You have finished the lab by logging into the AWS console with the administrator role

External Links

• AWS Official Docs on SAML Federation
• Microsoft Docs on ADFS Configuration
• AWS CLI with SAML Guide

Conclusion

Using Windows Active Directory ADFS and SAML 2.0 to log in to AWS Console. These steps provide a general overview of the process. The specific configuration details may vary depending on your environment and setup. It’s recommended to consult the relevant documentation from AWS and Microsoft for detailed instructions on setting up the integration between ADFS, SAML, and AWS. I hope will this your helpful. Thank you for reading the DevopsRoles page!

In this tutorial, How to Reduce AWS Billing & Setup Email Alerts.

Setup AWS Billing email alert

You need to login to AWS Console as a Root user

Follow these steps on aws:

Choice “My Billing Dashboard“

Create a budget

Choice “Cost budget“

Example, My “Budgeted amount” is 15 USD.

Input: Email contacts for Alerts

Final, Create it

Conclusion

You have set up Email Alerts to reduce AWS Billing. I hope will this your helpful. Thank you for reading the DevopsRoles page!

In this article, we’ll learn about Amazon Elastic Compute Cloud (Amazon EC2) and Amazon Elastic Block Store (Amazon EBS). Now, let’s go to AWS Certified Solutions Architect Exercises.

AWS Certified Solutions Architect Exercises

1. Today tasks

• Launch and Connect to a Linux Instance
• Launch a Windows Instance with Bootstrapping
• Launch a Spot Instance
• Access Metadata
• Create an Amazon EBS Volume and Show That It Remains After the Instance Is Terminated
• Take a Snapshot and Restore

2. Before you begin

• Puttygen.exe: Tool creating a .ppk file from a .pem file

• Command-line tool to SSH into the Linux instance.

3. Let do it

EXERCISE 1: Launch and Connect to a Linux Instance

In this exercise, you will launch a new Linux instance, log in with SSH, and install any security updates.

1. Launch an instance in the Amazon EC2 console.

2. Choose the Amazon Linux 2 AMI (HVM), SSD Volume Type – ami-0c3fd0f5d33134a76.

3. Choose the t2.micro instance type.

4. Configure Instance Details as below

• Network: Launch the instance in the default VPC.
• Subnet: Select a default subnet
• Auto-assign Public IP: Enable.

• 

5. Add Storage setting default, click 「Next: Add tags」button, next screen, you click 「Add tag」button to add a tag to the instance

Example: add a tag with Key is Name, the value of Key: ec2-demo.

6. Create a new security group called demo-sg.

7. Add a rule to demo-sg :

7.1. Allowing SSH access from the IP address of your computer with: Source is My IP(to secure this way is recommended)

7.2. Allowing all IP access with Source is Custom, CidrIP:0.0.0.0/0.

• 

8. Review and Launch the instance.

9. When prompted for a key pair, choose a key pair you already have or create a new one and download the private portion. Amazon generates a keyname.pem file, and you will need a keyname.ppk file to connect to the instance via SSH. Puttygen.exe is one utility that will create a .ppk file from a .pem file.

10. SSH into the instance using the IPv4 public IP address,

• 

To SSH to EC2 created, you able to use tools such as Terraterm

• 

and the user name ec2-user, and the keyname.ppk file created at step 9.

• 

11. From the command-line prompt, run

sudo yum update

12. Close the SSH window and terminate the instance.

EXERCISE 2: Launch a Windows Instance with Bootstrapping

In this exercise, you will launch a Windows instance and specify a very simple bootstrap script. You will then confirm that the bootstrap script was executed on the instance.

1. Launch an instance in the Amazon EC2 console.

2. Choose the Microsoft Windows Server 2019 Base AMI.

3. Choose the t2.micro instance type.

4. Launch the instance in either the default VPC and default subnet, Auto-assign Public IP: Enable.

5. In the Advanced Details section, enter the following text as UserData:

<script>
md c:\temp
</script>

• 

6. Add a tag to the instance of Key: Name, Value: EC2-Demo2

7. Use the demo-sg security group from Exercise 1.

8. Launch the instance.

9. Use the key pair from Exercise 1.

10. On the Connect to Your Instance screen, decrypt the administrator password and then download the RDP file to attempt to connect to the instance. Your attempt should fail because the demo-sg security group does not allow RDP access.

• 

11. Open the demo-sg security group and add a rule that allows RDP access from your IP address.

• 

12. Attempt to access the instance via RDP again.

13. Once the RDP session is connected, open Windows Explorer and confirm that the c:\temp folder has been created.

14. End the RDP session and terminate the instance.

EXERCISE 3: Launch a Spot Instance

In this exercise, you will create a Spot Instance.

1. Launch an instance in the Amazon EC2 console.

2. Choose the Amazon Linux AMI.

3. Choose the instance type.

4. On the Configure Instance page, request a Spot Instance.

5. Launch the instance in either the default VPC and default subnet, Auto-assign Public IP: Enable.

6. Request a Spot Instance and enter a bid a few cents above the recorded Spot price.

• 

7. Finish launching the instance.

8. Go to the Spot Request page. Watch your request.

• 

9. Find the instance on the Instances page of the Amazon EC2 console.

10. Once the instance is running, terminate it.

EXERCISE 4: Access Metadata

In this exercise, you will access the instance metadata from the OS.

1. Execute steps as in EXERCISE 1.

2. At the Linux command prompt, retrieve a list of the available metadata by typing:
curl http://169.254.169.254/latest/meta-data/

3. To see a value, add the name to the end of the URL. For example, to see the security groups, type:
curl http://169.254.169.254/latest/meta-data/security-groups

4. Close the SSH window and terminate the instance.

EXERCISE 5: Create an Amazon EBS Volume and Show That It Remains After the Instance Is Terminated

In this exercise, you will see how an Amazon EBS volume persists beyond the life of an instance.

1. Execute steps as in EXERCISE 1.

2. However, in step 5 「Add Storage 」, add a second Amazon EBS volume of size 50 GB. Note that the Root Volume is set to Delete on Termination.

3. Launch the instance, has two Amazon EBS volumes on the Amazon EBS console, Name them both 「EC2-Demo5」.

• 

4. Terminate the instance.

5. Check that the boot drive is destroyed, but the additional Amazon EBS volume remains and now says Available. Do not delete the Available volume.

• 

EXERCISE 6: Take a Snapshot and Restore

This exercise guides you through taking a snapshot and restoring it in three different ways.

1. Find the volume you created in Exercise 5 in the Amazon EBS Menu.

2. Take a snapshot of that volume. Tag with Name the snapshot Exercise-6, wait for the snapshot to be completed.

3. Method 1 to restore EBS volume: On the Snapshot console, choose the new snapshot created at step2 and select Create Volume, create the volume with all the defaults, tag with Name is 「Exercise-6-volumn-restored」

4. Method 2 to restore EBS volume: Locate the snapshot again, choose to Create Volume, setting the size of the new volume to 100 GB (restoring the snapshot to a new, larger volume is how you address the problem of increasing the size of an existing volume). Tag with Name is 「Exercise-6-volume-restored-100GB」

• 

5. Method 3 to restore EBS volume: Locate the snapshot again and choose Copy. Copy the snapshot to another region.

Go to the other region and wait for the snapshot to become available. Create a volume from the snapshot in the new region.

This is how you share an Amazon EBS volume between regions; that is, by taking a snapshot and copying the snapshot.

5. Delete all four volumes.

AWS Certified Solutions Architect Exercises- part 2 Amazon EC2 and Amazon EBS. I hope will this your helpful. Thank you for reading the DevopsRoles page!

In this series, let together will exercise these practices below

1. S3 Amazon Simple Storage Service and Amazon Glacier Storage
2. Amazon Elastic Compute Cloud (Amazon EC2) and Amazon Elastic Block Store (Amazon EBS)
3. Amazon Virtual Private Cloud (Amazon VPC)
4. Elastic Load Balancing, Amazon CloudWatch, and Auto Scaling
5. AWS Identity and Access Management (IAM)
6. Databases and AWS
7. SQS, SWF, and SNS
8. Domain Name System (DNS) and Amazon Route 53
9. Amazon ElastiCache
10. Additional Key Services
11. Security on AWS
12. AWS Risk and Compliance
13. Architecture Best Practices

Based on the document: AWS-Certified-Solutions-Architect-Official-Study-Guide.pdf

Now, start practicing!!!

1. AWS Certified Solutions Architect Exercises- part 1 Amazon S3 and Amazon Glacier Storage

1.1. Today’s tasks

1: Create an Amazon Simple Storage Service (Amazon S3) Bucket
2: Upload, Make Public, and Delete Objects in Your Bucket
3: Enable Version Control
4: Delete an Object and Then Restore It.
5: Lifecycle Management
6: Enable Static Hosting on Your Bucket

1.2. Before you begin

I default you have an AWS account.

1.3. Let’s do it

EXERCISE 1: Create an Amazon Simple Storage Service (Amazon S3) Bucket

1. Log in to the AWS Management Console at the link: https://console.aws.amazon.com/console/home?nc2=h_ct&src=header-signin

2. Choose an appropriate region, such as the Asia Pacific (Tokyo) Region.

3. Navigate to the Amazon S3 console. Notice that the region indicator now says Global. Remember that Amazon S3 buckets form a global namespace, even though each bucket is created in a specific region.

4. Start the create bucket process. Click the button Create bucket.

5. When prompted for Bucket Name, use yourname-demo-bucket-yyyymmdd.

6. Choose a region, such as Asia Pacific (Tokyo).

You should now have a new Amazon S3 bucket.

EXERCISE 2: Upload, Make Public, and Delete Objects in Your Bucket

In this exercise, you will upload a new object to your bucket. You will then make this object public and view the object in your browser. You will then rename the object and finally delete it from the bucket.

Upload an Object

1. Load your new bucket in the Amazon S3 console.

2. Select Upload, then Add Files.

3. Locate a file on your PC that you are okay with uploading to Amazon S3 and making public to the Internet. (We suggest using a non-personal image file for the purposes of this exercise.)

4. Select a suitable file, then Start Upload. You will see the status of your file in the Transfers section.

5. After your file is uploaded, the status should change to Done.

The file you uploaded is now stored as an Amazon S3 object and should be now listed in the contents of your bucket

Open the Amazon S3 URL

1. Now open the properties for the object. The properties should include bucket, name, and link.

2. Copy the Amazon S3 URL for the object.

3. Paste the URL in the address bar of a new browser window or tab.

You should get a message with an XML error code AccessDenied. Even though the object has a URL, it is private by default, so it cannot be accessed by a web browser.

Make the Bucket Public

1. Go back to the Permission tab of your bucket and set Block public access is Off.

2. Policy for everyone access with action is readonly

{
     "Version": "2012-10-17",
     "Id": "http referer policy example",
     "Statement": [
         {
             "Sid": "Allow get requests originating from global",
             "Effect": "Allow",
             "Principal": "",
             "Action": "s3:GetObject",             
             "Resource": "arn:aws:s3:::yourname-demo-bucket-yyyymmdd/"
         }
     ]
 }

2. Copy the Amazon S3 URL again and try to open it in a browser or tab. Your public image file should now display in the browser or browser tab.

3. Another public setting, read more at the link: https://aws.amazon.com/premiumsupport/knowledge-center/read-access-objects-s3-bucket/

Delete the Object

1. In the Amazon S3 console, select　Object ➝ Actions ➝ Delete. Choose Delete when prompted if you want to delete the object.

2. The object has now been deleted.

3. To verify, try to reload the deleted object’s Amazon S3 URL.
You should once again get the XML AccessDenied error message.

EXERCISE 3: Enable Version Control

In this exercise, you will enable version control on your newly created bucket.

Enable Versioning

1. In the Amazon S3 console, open your bucket. Click Properties tab ➝ Versioning ➝ select Enable versioning ➝ Save.

Your bucket now has versioning enabled.

Create Multiple Versions of an Object

1. Create a text file named foo.txt on your computer and write the word blue in the text file.

2. Save the text file to a location of your choosing.

3. Upload the text file to your bucket. This will be version 1.

4. After you have uploaded the text file to your bucket, open the copy on your local computer and change the word blue to red. Save the text file with the original filename.

5. Upload the modified file to your bucket.

6. Select Show Versions on the uploaded object.

You will now see two different versions of the object with different Version IDs and possibly different sizes. Note that when you select Show Version, the Amazon S3 URL now includes the version ID in the query string after the object name.

EXERCISE 4: Delete an Object and Then Restore It

In this exercise, you will delete an object in your Amazon S3 bucket and then restore it.

Delete an Object

Open the bucket containing the text file for which you now have two versions.

1. Select Hide Versions.
2. Select Actions ➝ Delete, and then select Delete to verify.
3. Your object will now be deleted, and you can no longer see the object.
4. Select Show Versions.
   Both versions of the object now show their version IDs.

Restore an Object

Open your bucket.

1. Select Show Versions.
2. Select the oldest version and download the object. Note that the filename is simply foo.txt with no version indicator.
3. Select Hide Versions, upload foo.txt to the same bucket.
4. The file foo.txt should re-appear, select Show Version.

EXERCISE 5: Lifecycle Management

In this exercise, you will explore the various options for lifecycle management.

1. Select your bucket in the Amazon S3 console.
2. Under Management ➝ Lifecycle, add a Lifecycle Rule.
3. Explore the various options to add lifecycle rules to objects in this bucket. It is recommended that you do not implement any of these options, as you may incur additional costs. After you have finished, click the Cancel button.

My example: transitions object to GLACIER storage class after 1days.

EXERCISE 6: Enable Static Hosting on Your Bucket

In this exercise, you will enable static hosting on your newly created bucket.

1. Select your bucket in the Amazon S3 console.

2. In the Properties section, select Static Website Hosting.

For the index document name, enter index.txt, and for the error document name, enter error.txt.

3. Use a text editor to create two text files and save them as index.txt and error.txt.
In the index.txt file, write the phrase “Hello World,” and in the error.txt file, write the phrase “Error Page.” Save both text files and upload them to your bucket.

4. Copy the Endpoint: link under Static Website Hosting and paste it in a browser window or tab. You should now see the phrase “Hello World” displayed.

5. In the address bar in your browser, try adding a forward slash followed by a made-up filename (for example, /test.html). You should now see the phrase “Error Page” displayed.

Finally is important, to clean up, delete all of the objects in your bucket and then delete the bucket itself. AWS Certified Solutions Architect Exercises- part 1 Amazon S3 and Amazon Glacier Storage. Thank you for reading the DevopsRoles page!