# Amazon Web Services

Setting up Amazon Web Services, requires two extra parameters, Role and RoleSessionName.

You can connect this parameters now if you have the fields configured, or set them later.

The RoleSessionName is typically mapped to the users email address

**Configuring SAML SSO for AWS**

[AWS documentation can be found here.](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html#idp-manage-identityprovider-console)

You will need Admin access to your AWS Console.

1. Sign into your **AWS Console**.
2. Navigate to the **IAM Dashboard** (Identity and Access Management).
3. In the IAM Dashboard, navigate to **Access Management** > **Identity Providers**
4. Click **Add provider**.
5. In the **Configure provider** section, select **SAML** as the **Provider type**, enter **Key9-Identity** as the **Provider name**.
6. For the **Metadata document**, **Download SAML Metadata** file from the side navigation of your Key9 application, then click **Choose file** and upload the metadata file.
7. Then click **Add provider**.
8. Copy the **ARN** displayed. (You will need this later when configuring access)
9. If you haven't yet, you will need to create a **Role**, that will be assigned to the **Key9 Identity** provider.\
   [Please refer to AWS docs for creating a Role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html)
10. Click **Assign role** button, then select whether you will **Create a new role** or **Use an existing role**, and follow the AWS docs.
11. Once you have a **Role(s)** assigned to Key9 Identity, copy the **ARN** displayed for each role. (You will need this later when configuring access)
12. When assigning a role to a user, the value will consist of the AWS ARN role and the AWS ARN provider, separated with a comma.

**An example of a role would be:**\
arn:aws:iam::123456789000:role/RoleNameHere,arn:aws:iam::123456789000:saml-provider/Key9-Identity

\-------------------

By default, applications are not active upon creation. Active applications are immediately available to assign groups. Applications should only be activated when you have configured the Service Provider (SP).


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.k9.io/key9-identity/web/marketplace/amazon-web-services.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.