# Connecting SailPoint and AWS SaaS

To connect SailPoint with AWS, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

> [!IMPORTANT]
>
> By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration.

**To configure a new source:**

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Configure**.
5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
8. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
9. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
10. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system.
   - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.
7. Select **Save**.

## Connection Settings

Securely connect SailPoint and to the Amazon Web Services SaaS source. The Amazon Web Services SaaS connector supports the IAM Role Authentication Method.

Permissions for the role must be configured in the management AWS account and a trust relationship must be established.

> [!IMPORTANT]
>
> To manage organizational entities like service control policies, organization units, or AWS accounts, you must provide the Management Account ID and role permissions must be configured in the management AWS account.

> [!NOTE]
>
> **Screenshot**
>
> [![Connection Settings](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/conn_settings.png>)](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/conn_settings.png>)

1. Enter the IAM **Role Name** that has authorization to call all the AWS accounts to be aggregated. This role must have the permissions specified in [Prerequisites](<https://documentation.sailpoint.com/connectors/aws/saas/help/index.html#prerequisites>) and [IAM Role Authentication Method](<https://documentation.sailpoint.com/connectors/aws/saas/help/required_permissions.html>).
2. Enter the **Region** name for the AWS data center. The default region is `us-east-1`.
3. The **External ID** is auto populated. You must copy the external ID provided by SailPoint, then paste it when configuring AWS.
4. Enter the **Management Account ID** for the organization. This is required to manage all AWS accounts as well as organization entities like service control policies, organization units.
5. Select **Save**.

## Aggregation Settings

1. Enter the number of records per page in **Page Size**.

   > **Screenshot**
   >
   > [![Aggregation Settings](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/page_set.png>)](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/page_set.png>)

   - Default: 10
   - Minimum: 1
   - Maximum: 1000

### Switch Role

You can change the role session name to a user friendly name that appears in the CloudTrail logs. You can specify the role and the duration of the session for that role to be used. For more information about how AWS handles this feature, refer to [Switching to a role (console)](<https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-console.html>) in the AWS documentation.

> [!NOTE]
>
> This configuration has been moved from the API to the user interface.

> [!NOTE]
>
> **Screenshot**
>
> [![Switch Role](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/aws_agg_role_session.png>)](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/aws_agg_role_session.png>)

1. Enter the role name to be used in **Role Session Name**.
2. Specify the length of the session in **Role Session Duration in Seconds**.

   - Default: 3600 (1 hour)
   - Maximum: 43200 (12 hours)
   - Minimum: 3600 (1 hour)
3. Select **Save**.

## Machine Identity Governance Settings

> [!NOTE]
>
> Your organization must have SailPoint Agentic Fabric to discover agents. AWS IAM Credentials and AWS Secrets Manager credential discovery require SAF Datasets. Contact your Customer Success team for more information. For more information, refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>).

Enable and configure aggregation settings for machine identities in AWS Bedrock, AWS Bedrock AgentCore, AWS IAM, AWS Secrets Manager, Amazon Connect Customer, and Amazon Quick, and AWS Agent Registry.

### Prerequisites

Before you can configure agent governance in the connector, you must set the agent governance policies to configure how the connector handles these accounts. For more information, refer to [Machine Identity Governance Policies](<https://documentation.sailpoint.com/connectors/aws/saas/help/required_permissions.html#machine-identity-governance-policies>).

> [!NOTE]
>
> **Screenshot**
>
> [![Machine Identity Governance Settings](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/amazon_connect_customer_agent_settings.png>)](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/amazon_connect_customer_agent_settings.png>)

1. Select **Enable Amazon Bedrock Agents** to include AWS Bedrock AI agents in governance.
2. Enter the **Regions** code (e.g. us-east-1) to look for AWS Bedrock AI agents. Press **Enter** to add the region name into a growing list. For more information about the support of this regional service, refer to [AWS Regions](<https://docs.aws.amazon.com/bedrock/latest/userguide/agents-supported.html>) in the AWS documentation.
3. Select **Enable Amazon Bedrock AgentCore Agents** to include AWS Bedrock AgentCore AI agents in governance.
4. Enter the **Regions** code (e.g. us-east-1) to look for AWS Bedrock AgentCore AI agents. Press **Enter** to add the region name into a growing list. For more information about the support of this regional service, refer to [AWS Regions](<https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-regions.html>) in the AWS documentation.
5. Select **Enable AWS Secrets Manager** to include AWS Secrets Manager in governance.
6. Enter the **Regions** code (e.g. us-east-1) to look for AWS Secrets Manager secrets. Press **Enter** to add the region name into a growing list. For more information about the support of this regional service, refer to [AWS Regions](<https://docs.aws.amazon.com/general/latest/gr/asm.html>) in the AWS documentation.
7. Select the **Enable Amazon Connect Customer Agents** toggle to discover Amazon Connect Customer AI agents.
8. Enter a region code in **Regions** (for example, `us-east-1`). Refer to [Amazon Connect endpoints and quotas](<https://docs.aws.amazon.com/general/latest/gr/connect_region.html>) for regional availability. The connector discovers Amazon Connect Customer AI agents only in regions where Amazon Q in Connect is enabled for the instance.

   > **Note**
   >
   > The linked document is not maintained by SailPoint and is subject to change without notice.
9. Select the **Enable Amazon Quick** toggle to discover Amazon Quick agents and action connectors.
10. Enter a region code in **Regions** (for example, `us-east-1`). The connector discovers Amazon Quick resources in the following regions:

    - `us-east-1`
    - `us-west-2`
    - `ap-southeast-2`
    - `ap-northeast-1`
    - `eu-central-1`
    - `eu-west-1`
    - `eu-west-2`

    Refer to [Amazon QuickSight endpoints and quotas](<https://docs.aws.amazon.com/general/latest/gr/quicksight.html>) for regional availability.

    > **Note**
    >
    > The linked document is not maintained by SailPoint and is subject to change without notice.
11. Select the **Enable AWS Agent Registry** toggle to discover Agent Registry catalog records.

    > **Note**
    >
    > The AWS Agent Registry dataset (`aws:agent-registry`) is aggregated by the AWS SaaS connector through resource listing. It is not routed to Cloud Infrastructure Entitlement Management (CIEM).
12. Enter a region code in **Regions** (for example, `us-east-1`). The connector discovers AWS Agent Registry records in the following regions:

    - `us-east-1`
    - `us-west-2`
    - `eu-west-1`
    - `ap-northeast-1`
    - `ap-southeast-2`

    Refer to [Supported AWS Regions](<https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-regions.html>) for regional availability.

    > **Note**
    >
    > The linked document is not maintained by SailPoint and is subject to change without notice.

### Configuring IAM Credential Discovery

Enable and configure aggregation of durable IAM user credentials as non-human identities (NHIs).

> [!NOTE]
>
> IAM credential discovery supports aggregation only. Enabling, disabling, and deleting credential resources are not supported.

> [!NOTE]
>
> **Screenshot**
>
> [![Configuring IAM Credential Discovery](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/aws_iam_credentials_settings.png>)](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/aws_iam_credentials_settings.png>)

1. Select the **Enable AWS IAM Credentials** toggle to discover IAM user credentials.
2. Select the credential types to aggregate:

   - **Include Access Keys**
   - **Include CodeCommit HTTPS Credentials**
   - **Include CodeCommit SSH Keys**
   - **Include Signing Certificates**

   During source onboarding, all four credential types are selected by default. IAM access keys are enabled during source creation.
3. Select **Save**.
4. Run aggregation for the **AWS IAM Credentials** dataset.

## Additional Settings

Configure the settings for retry attempts when a timeout error occurs. For detailed information about AWS recommendations, refer to [Retries and backoff in the Amazon Builder's Library](<https://aws.amazon.com/builders-library/timeouts-retries-and-backoff-with-jitter/#Retries_and_backoff>).

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

> [!NOTE]
>
> **Screenshot**
>
> [![Additional Settings](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/additional_settings.png>)](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/additional_settings.png>)

1. In **Maximum Retry Limit**, specify the number of retries to attempt before the connection terminates with an error log message.
2. In **Base Delay in Milliseconds**, specify the amount of time to wait before retrying the connection. The base delay exponentially increases after every retry attempt. For example, if the default base delay is 10 seconds, subsequent retry attempts will be 20 seconds, then 40 seconds, and so on. Default: 500
3. In **Throttled Base Delay in Milliseconds**, specify the amount of time to wait if the initial retry fails. This time duration increases after every retry attempt. The value automatically increases exponentially with each failed attempt. Default: 1000
4. In **Maximum Backoff Time in Milliseconds**, specify the amount of time to wait between attempts. After the delay reaches this maximum limit, the time between retries will stop increasing. Default: 20000

### Provisioning Configuration

> [!NOTE]
>
> **Screenshot**
>
> [![Provisioning Configuration](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/additional_provisioning.png>)](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/additional_provisioning.png>)

1. In **Change Password Policy ARN**, provide the Amazon Resource Name (ARN) used to create AWS accounts or to handle password changes.
2. Select **Save**.

## Activity Data Insights

SailPoint pulls in activity data in the form of events like user logins, password changes, and content updates within the application. You can view an identity’s activity data within an application to discover trends for that user. Activity Insights supports activity of IAM Users from the respective AWS Accounts. This allows you to gather account information and activity data from Amazon Web Services

> [!IMPORTANT]
>
> Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to [Activity Insights](<https://documentation.sailpoint.com/saas/help/ai/activity_insights/index.html>).

The AWS SaaS connector requires `AWSCloudTrail_ReadOnlyAccess` permissions to pull activity data for AWS sources. For more information, refer to [AWSCloudTrail\_ReadOnlyAccess](<https://documentation.sailpoint.com/connectors/aws/saas/help/required_permissions.html#non-multiple-group-object-source-policies>) in *Required Permissions*.

> [!NOTE]
>
> Activity Data Insights (ADI) is only supported for Commercial accounts that are not supported by GovCloud accounts.

To configure Activity Insights, complete the following:

> [!NOTE]
>
> **Screenshot**
>
> [![Activity Data Insights](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/adi.png>)](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/adi.png>)

1. To opt-in to the ADI feature and receive activity data, enable the **Enable Activity Insights** option. To opt-out, leave the option disabled.
2. Select **Save**.

> [!NOTE]
>
> **IAM role trust policy requirement for Activity Insights**
>
> Activity Insights collects data using SailPoint's `ciem_universal role`, which passes session tags when assuming your AWS source role. To allow this, the trust policy of the role you created for the AWS SaaS source must permit `sts:TagSession` in addition to `sts:AssumeRole`.
>
> Update your AWS source role's trust policy like given below:
>
> ```json
> {
>   "Version": "2012-10-17",
>   "Statement": [
>     {
>       "Effect": "Allow",
>       "Principal": { "AWS": ["arn:aws:iam::874540850173:role/ciem_universal"] },
>       "Action": ["sts:AssumeRole", "sts:TagSession"],
>       "Condition": { "StringEquals": { "sts:ExternalId": "<externalId>" } }
>     }
>   ]
> }
> ```

## Cloud Infrastructure Entitlement Management (CIEM) Settings

> [!IMPORTANT]
>
> You must have a CIEM license to enable cloud governance features. Contact your SailPoint Customer Success Manager to request access. For more information, refer to the [SailPoint CIEM Overview](<https://documentation.sailpoint.com/saas/help/ciem/index.html>).

> [!NOTE]
>
> For additional information on CIEM settings, refer to [Configuring Amazon Web Services](<https://documentation.sailpoint.com/saas/help/ciem/aws/config/index.html>).

1. Select **Enable Cloud Infrastructure Entitlement Management (CIEM)** to view access to cloud resources and infrastructure granted through entitlements.

   > **Screenshot**
   >
   > [![Cloud Infrastructure Entitlement Management (CIEM) Settings](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/ciem_settings.png>)](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/ciem_settings.png>)
2. Enter the **CloudTrail ARN** for an organization or individual member account. You can add up to 150 CloudTrail ARNs, separated by commas.
3. Enter the AWS **CloudTrail Bucket Account ID** where the CloudTrail bucket is hosted.
4. Select **Save**.

## AWS Account Settings

1. In the **AWS Accounts** field, use the drop-down list to select the accounts you want to include in aggregation.

   > **Screenshot**
   >
   > [![AWS Account Settings](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/aws_accounts.png>)](<https://documentation.sailpoint.com/connectors/aws/saas/help/img/aws_accounts.png>)
2. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.