IAM SAML provider exists in the account

Check ID: iam_check_saml_providers_sts
Provider: AWS
Service: iam
Severity: LOW
Categories: identity-access
Resource type: Other

What this check verifies

IAM SAML providers enable federated role assumption via STS AssumeRoleWithSAML. This evaluates whether such providers exist in the account.

Risk

Without SAML federation, users rely on long-lived IAM keys. Compromised keys enable persistent API access, causing data exfiltration (C), unauthorized resource or policy changes (I), and difficult revocation. Lack of IdP controls (e.g., MFA, session limits) weakens accountability and access governance.

Recommendation

Adopt SAML federation to issue short-lived STS credentials. Map users to roles with least privilege, enforce MFA at the IdP, and set conservative session durations. Retire IAM user access keys for interactive use and monitor role sessions as defense in depth. If federation isn’t possible, tightly scope, rotate, and audit keys.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam create-saml-provider —name <SAML_PROVIDER_NAME> —saml-metadata-document file://<SAML_METADATA_XML_FILE>

# Create an IAM SAML provider to satisfy the check
resource "aws_iam_saml_provider" "<example_resource_name>" {
  name                   = "<example_resource_name>"
  saml_metadata_document = file("<SAML_METADATA_XML_FILE>") # Critical: creates the SAML provider so the check passes
}

# CloudFormation: create an IAM SAML provider to satisfy the check
Resources:
  <example_resource_name>:
    Type: AWS::IAM::SAMLProvider
    Properties:
      SamlMetadataDocument: "<SAML_METADATA_XML_CONTENT>"  # Critical: creates the SAML provider so the check passes
      Name: <example_resource_name>

References

https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_check_saml_providers_sts. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires