mirror of
https://github.com/goauthentik/authentik
synced 2026-04-28 02:18:11 +02:00
6ed5cb5249
* website/integrations: rename "Create with Provider" to "New Application" The application list page now uses a split-button labeled "New Application" instead of the old "Create with Provider" dropdown. Update all 113 integration guides to match. * website/docs: update flow, stage, and policy button labels - "Create" → "New Flow", "New Stage", "New Policy" for trigger buttons - "Finish" → "Create Flow", "Create Stage", "Create Policy" for submit - "Create and bind stage" → "New Stage" / "Bind Existing Stage" - "Create" (binding submit) → "Create Stage Binding" * website/docs: update provider button labels - "Create" → "New Provider" for trigger buttons - "Create with Provider" → "New Application" in RAC docs - "Create" → "New Property Mapping", "New RAC Endpoint", "New Prompt" for related entity creation * website/docs: update directory button labels - "Create" → "New Source" for federation/social login pages - "Create" → "New Role", submit → "Create Role" - "Create" → "New Invitation" - Policy binding submit → "Create Policy Binding" * website/docs: update endpoint device and system management button labels - "Create" → "New Endpoint Connector", "New Enrollment Token", "New Device Access Group", "New Flow" - Submit → "Create Device Access Group" - "Create" → "New Notification Rule", "New Notification Transport" - Binding submit → "Create Policy Binding" * Reorganize policy documentation * website/docs: address policy docs review feedback * post-rebase * website/docs: Reorganize policy documentation -- Revisions (#21601) * apply suggestions * Fix escaped. * Fix whitespace. * Update button label. * Fix phrasing. * Fix phrasing. * Clean up stragglers. * Format. --------- Co-authored-by: Dominic R <dominic@sdko.org>
97 lines
4.3 KiB
Plaintext
97 lines
4.3 KiB
Plaintext
---
|
|
title: AWS CLI authentication
|
|
sidebar_label: AWS
|
|
tags: [authentik Agent, authentik cli, aws, cli]
|
|
authentik_version: "2025.12.0"
|
|
---
|
|
|
|
You can use the authentik Agent to authenticate to the AWS CLI with authentik credentials.
|
|
|
|
## Prerequisites
|
|
|
|
- The authentik Agent must be deployed on your device.
|
|
|
|
## authentik configuration
|
|
|
|
To support the integration of authentik Agent with AWS CLI, you need to create an application/provider pair in authentik.
|
|
|
|
### Create an application and provider in authentik for AWS CLI
|
|
|
|
1. Log in to authentik as an administrator and open the authentik Admin interface.
|
|
2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
|
|
- **Application**: provide a descriptive name (e.g. `authentik-aws-cli`), an optional group for the type of application, the policy engine mode, and optional UI settings.
|
|
- **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.
|
|
- **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
|
|
- Set the **Client type** to `Public`.
|
|
- Set the **Client ID** to `authentik-aws-cli`.
|
|
- Select any available signing key.
|
|
- Under **Machine-to-Machine authentication settings** add the `authentik-cli` provider as a **Federated OIDC Provider**.
|
|
- **Configure Bindings** _(optional)_: you can create a [binding](../../../../add-secure-apps/bindings-overview/index.md) (policy, group, or user) to manage access to the application.
|
|
|
|
3. Click **Submit** to save the new application and provider.
|
|
|
|
## AWS configuration
|
|
|
|
To support the integration of AWS with the authentik Agent, you need to configure authentik CLI as an IdP and set up permission roles in AWS.
|
|
|
|
### Configure authentik CLI as an IDP in AWS
|
|
|
|
1. Log in to the AWS Management Console as an administrator that has permissions to create IAM roles and identity providers.
|
|
2. Open the [IAM Console](https://console.aws.amazon.com/iam/) and in the left sidebar under **Access Management**, click **Identity providers**.
|
|
3. Click **Add provider** and configure the following fields:
|
|
- **Provider type**: `OpenID Connect`
|
|
- **Provider URL**: `https://authentik.company/application/o/<application-slug>/`
|
|
- **Audience**: `authentik-aws-cli`
|
|
4. Click **Add provider**
|
|
5. On the **Identity providers** page, click on the name of the provider that you just added.
|
|
|
|
### Configure permissions in AWS
|
|
|
|
1. Log in to the AWS Management Console as an administrator that has permissions to create IAM roles and identity providers.
|
|
2. Open the [IAM Console](https://console.aws.amazon.com/iam/) and in the left sidebar under **Access Management**, click **Roles**.
|
|
3. Either create or edit a role that you want authentik users to be able to use.
|
|
4. Open the **Trust relationships** tab.
|
|
5. Click **Edit trust policy** and add the following, replacing `<account_id>` with your AWS Account ID:
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"Federated": "arn:aws:iam::<account_id>:oidc-provider/authentik.company/application/o/authentik-aws-cli/"
|
|
},
|
|
"Action": "sts:AssumeRoleWithWebIdentity",
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"authentik.company/application/o/authentik-aws-cli/:aud": "authentik-aws-cli"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
6. Click **Update policy**.
|
|
7. Take note of the role ARN as it will be required in the next section.
|
|
|
|
### Configure AWS CLI to authenticate with authentik CLI
|
|
|
|
On the device running AWS CLI, update the `~/.aws/credentials` file with the following, replacing `<role_arn>` with the ARN of the role above:
|
|
|
|
```
|
|
[default]
|
|
credential_process = ak auth aws --client-id authentik-aws-cli --role-arn <role_arn>
|
|
```
|
|
|
|
To verify, run `aws sts get-caller-identity`, which should output something like this
|
|
|
|
```json
|
|
{
|
|
"UserId": "xxxxxx",
|
|
"Account": "<account_id>",
|
|
"Arn": "arn:aws:sts::<account_id>:assumed-role/<role name>/<authentik username>"
|
|
}
|
|
```
|