Skip to content
Download

Connectors

AWS sign-in

Every AWS tool in Oddboro uses one sign-in to your AWS account. This guide finds the two details it needs and makes Oddboro a user of its own. It takes about five minutes, once.

How Oddboro signs in

Oddboro signs in through IAM Identity Center, on AWS’s own page, and keeps the sign-in on this computer. Each AWS tool then uses one role you make for it, so your Odds get only the access you choose.

Before you start

  1. You need administrator access to an AWS account with IAM Identity Center turned on. If it is off, AWS’s guide turns it on.
  2. If your account belongs to an AWS organization, as AWS’s projects sign-up makes, do every AWS part in the organization’s management account, not the project’s account.

Part 1. Find your sign-in details (in AWS)

  1. Open IAM Identity Center, signed in to the AWS console as an administrator.

    https://console.aws.amazon.com/singlesignon Go to (opens in a new tab)

  2. Click Dashboard.

    If you see Enable instead, Identity Center runs in another Region. Change the Region menu at the top right until the Dashboard shows.

  3. Under AWS access portal URLs, copy the IPv4-only URL.

    It goes in Oddboro’s “AWS access portal URL” box, which fills in the Region from it. An older account shows a single URL ending in /start instead: copy that one.

    https://ssoins-xxxxxxxxxxxxxxxx.us-east-1.portal.amazonaws.com

  4. Under Settings summary, note the Primary Region, such as us-east-1.

    This is your Identity Center Region. If Oddboro did not fill it in from the URL, type it in Oddboro’s “Identity Center Region” box.

Part 2. Turn on multi-account permissions (in AWS)

Oddboro’s roles are permission sets, which newer AWS accounts start with turned off. If the left menu already shows Multi-account permissions, skip this part.

  1. In the left menu, click Settings.

  2. Click the Management tab.

  3. Under Multi-account permissions, click Enable.

    If AWS asks you to confirm, confirm. Status changes to Enabled, and Multi-account permissions shows in the left menu.

Part 3. Make a user for Oddboro (in AWS)

Oddboro keeps this sign-in, so give it a user of its own that holds only the roles you make for Oddboro. If AWS will not let you add a user, skip this part and use your own: wherever a guide says oddboro, pick your own user instead.

  1. In the left menu, click Users.

  2. Click Add user.

  3. For Username, type this.

    oddboro

  4. Keep “Send an email to this user with password setup instructions”.

  5. Enter an email address you can read, and a first and last name.

  6. Click Next.

  7. Click Next again.

    Groups are not needed.

  8. Click Add user.

  9. Open the email titled “Invitation to join AWS IAM Identity Center”.

  10. Click Accept invitation.

  11. Set a password.

    If AWS asks you to register an MFA device, register one.

Next: the tool you want

If something goes wrong

AWS says I am not authorized to perform sso:CreateInstance.
Your account belongs to an AWS organization, and its IAM Identity Center lives in the organization’s management account. Switch to the management account in the account menu at the top right, and do the AWS parts there. Oddboro reaches your other accounts, such as a project’s, through it.
AWS will not let me add an oddboro user.
Some accounts, such as one whose Identity Center uses AWS Builder ID, cannot add users. Use your own user instead: give each role to yourself in the “Give it to the Oddboro user” part, and sign in to Oddboro as yourself. Oddboro then lists every role your user has, and each tool uses only the one you pick for it.
I see Enable on every Region’s Dashboard.
IAM Identity Center is not on yet for this account. AWS’s guide to enabling it is linked under Before you start.
“Your AWS user has no roles yet.”
The oddboro user has no permission set in that account yet. Do the “Give it to the Oddboro user” part, wait a minute, then click Look again.
AWS asks me to sign in again every day.
Identity Center ends a sign-in after 8 hours unless you change it. In IAM Identity Center, click Settings, then the Authentication tab, then Configure next to Session duration. It goes up to 90 days.