Multiple Azure AD SAML providers with one AWS account
Hi, I've successfully setup SAML authentication to AWS using the various guides online without issue. As part of those guides the roles are created in IAM with a trust assignment to the SAML provider as well as a condition. However, whilst I've seen multiple tutorials on how to map an Azure AD account to multiple AWS accounts, I would like to do the opposite:
Due to Geo-Location requirements, we have multiple Azure AD tenancies, which each need to be granted access to AWS, I can easily create the providers for each tenancy, etc and I was hoping to add all the providers to the trusted principals array in the IAM policy. Unfortunately doing this shows the role in the user management list, but it is disabled and I cannot select it.
Further testing shows that Azure shows the roles as enabled only if they have a single federated principal regardless of what it is, however I would only be able to switch to that role from the matching Azure tenancy. Therefore I have to create roles for each tenancy which seems excessive and also shows multiple redundant options in the user management list. Is there any other option?
Thanks
John