Configure Amazon Web Services (AWS) auto-provisioning

1. Sign in to your Amazon Web Services Console at https://console.aws.amazon.com.
2. At top left, click ServicesAll ServicesIAM Identity Center (successor to AWS Single Sign-On). Alternatively, you can search for IAM Identity Center using the search box.
3. From the Dashboard, under Recommended setup steps, click Step 1, Choose your identity source.
4. On the Settings page, in the Identity source section, click ActionsChange identity source.
5. Under Choose identity source, select External identity provider.
6. Click Next.
7. Under Identity provider metadata, go to IdP SAML metadata and click Choose file.
8. Upload the IDP Metadata (GoogleIDPMetadata.xml) that you downloaded when you set up SSO for this app, then click Next.
9. On the Confirm change page, scroll down to Review and confirm and enter ACCEPT in the entry field.
10. Click Change identity source.
    This completes auto-provisioning configuration and returns you to the Settings page.
11. In the Automatic provisioning section, click Enable.
12. Copy and save the SCIM endpoint that's displayed in the popup.
13. Click Show tokencopy the Access tokenclick Close.
14. To find the SCIM endpoint and a new token anytime after completing the above steps, go to IAM Identity CenterSettings. In the Identity source tab, click the Actions menu and select Manage provisioning.
    • Under Configuration, copy the SCIM endpoint.
    • Under Access tokens, click Generate token and copy the new token.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsWeb and mobile apps.

3. Open the Amazon Web Services application.
4. (Optional) To limit auto-provisioning to certain users, click User access and select the organizational units or groups that should have access to the Amazon Web Services application. Alternately, if you are using groups (not organization units) to control auto-provisioning, you can do that in step 10 below. 
5. In the Autoprovisioning section, click Configure autoprovisioning.
6. Paste the API access token you copied from Amazon Web Services and click Continue.
7. Enter the SCIM endpoint you copied from Amazon Web Services click Continue.
8. Verify that all mandatory Amazon Web Services attributes (those marked with an *) are mapped to Google Cloud Directory attributes. If not, click the Down arrow  and map to the appropriate attribute.
9. Click Continue.
10. (Optional) Restrict provisioning to specific groups:
    1. Enter all or part of a group name in the Search groups field.
    2. A list of available groups appears. Select a group to add it and open a new search field.
    3. If necessary, add more groups and choose a scope. 
    4. To remove any group you added, click  next to it.
11. Click Continue.
12. Choose how long deprovisioning actions should be delayed before taking effect. The amount of time before deprovisioning takes effect can be set to: within 24 hours or after one, 7, or 30 days. Select at least one of these options:
    • When an app is turned off for the user, suspend their account after [number of days].
    • When a user is suspended on Google, suspend their account after [number of days].
    • When a user is deleted from Google, suspend their account after [number of days].
13. Click Finish.
14. In the Auto-provisioning section, click the activation slider.
     

    Note: The activation slider is disabled if Amazon Web Services isn’t turned on for any users. Click User access and turn the app on to enable the slider.

15. In the confirmation dialog box, click Turn on.

Once provisioning is on, Google starts collecting usage information. You'll see the usage information in the Auto-provisioning section. There won't be any numbers next to the event names until you enable provisioning.

The following event names provide the usage information for the last 30 days:

• Create User By Auto Provisioning
• Update Auto Provisioned User
• Suspend Auto Provisioned User
• UnSuspend Auto Provisioned User
• Hard Delete Auto Provisioned User
• Failures

For more information, see Monitor automated user provisioning.

You may want to restrict the scope of provisioning to members of groups you define. 

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsWeb and mobile apps.

3. Open the Amazon Web Services application.
4. Click the Auto-provisioning section to open the settings page.
5. Under Provisioning scope, click Edit.
6. Enter all or part of a group name in the Search groups field. A list of available groups appears.
   1. Select a group to add it and open a new search field.
   2. If necessary, add more groups and choose a scope. 
   3. To remove any group you added, click  next to it.

   If a group has users from a secondary domain or from outside the organization, those users are not provisioned.

7. Once you’re done, click Update.

The next time you edit provisioning scope, the groups you added appear in the Provisioning scope window. If you turned on the Amazon Web Services application for a set of organizational units, the provisioning scope is restricted to those users in the added groups who are also members of those organizations.

To disable auto-provisioning for the Amazon Web Services application without losing all the configuration information:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsWeb and mobile apps.

3. Open the Amazon Web Services application.
4. Do one of the following:
   • In the Auto-provisioning section, click the activation slider.
   • Click the Auto-provisioning section to open the settings page, then click StatusTurn off.
5. In the confirmation dialog box, click Turn off.

To define how long deprovisioning actions should be delayed before taking effect:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsWeb and mobile apps.

3. Open the Amazon Web Services application.
4. Click the Auto-provisioning section to open the settings page.
5. Under Deprovisioning, click Edit.
6. Choose how long deprovisioning actions should be delayed before taking effect. The amount of time before deprovisioning takes effect can be set to: within 24 hours or after one, 7, or 30 days. Select at least one of these options:
   • When an app is turned off for the user, suspend their account after [number of days].
   • When a user is suspended on Google, suspend their account after [number of days].
   • When a user is deleted from Google, suspend their account after [number of days].
7. Click Update to save your edited deprovisioning configuration.

To disable auto-provisioning for the Amazon Web Services application and remove all the configuration information:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsWeb and mobile apps.

3. Open the Amazon Web Services application.
4. Click the Auto-provisioning section to open the settings page.
5. Under Delete configuration, click Delete.
6. Click Delete to both deactivate auto-provisioning and remove all the configuration information.
   Existing users on Amazon Web Services will not be deprovisioned.

If the admin password for Amazon Web Services has changed, automatic provisioning will stop working. In this case, the original authorization is revoked by Amazon Web Services, and you must reauthorize automatic provisioning.

1. Follow the steps in Get the API access token for the Amazon Web Services application, above, to get a new access token from Amazon Web Services.
2. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

3. In the Admin console, go to Menu  AppsWeb and mobile apps.

4. Click the Amazon Web Services application.
5. Click the Auto-provisioning section to open the settings page.
6. Under App authorization, click Reauthorize.
7. Enter your  Amazon Web Services access token, then click Re- authorize.

After reauthorization completes, you're returned to the Auto-provisioning settings page in the Admin console.

Note: Your third-party application might revoke authorization for reasons other than the admin password changing. These reasons can include account inactivity, for example. Check with the documentation for the third-party application for scenarios in which authorization can be revoked.