Create an IAM Identity Center application

1. Login to the AWS console and open IAM Identity Center.

2. Navigate to Applications → Add application.

3. Select I have an application I want to setup and chose SAML 2.0.

4. Enter the following details

   • Display name: Sandbox Studio (or your preferred name)

   • Description: e.g. Sandbox Studio allows users to access AWS sandbox accounts

   • Leave Application start URL and Relay state blank.
   • Application Metadata
     • Select Manually type your metadata values

     • Application ACS URL will be
       https://<your-app-url>/api/auth/login/callback
       (for now, use the CloudFrontDistributionUrl; if you later add a custom domain, come back and update this)

     • Audience (Entity ID): SandboxStudio

     • Submit.
5. From the list of applications, choose the SAML application you just set up.
6. Click Actions → Edit attribute mappings.
7. Enter the following attributes:

   User attribute in the application	Maps to this value...	Format
   Subject	${user:email}	emailAddress
   ID	${user:AD_GUID}	unspecified

8. Save changes.
9. On the application, page click Assign users or groups.
10. Assign the three groups created by the SandboxStudio-IDC stack (Admin / Manager / User) to this application.
11. Done.

You have now successfully set up a custom IAM Identity Center Application.

Extract application details

Before proceeding to the next step, you will need to extract the following information which will be used in subsequent steps.

1. Click Actions → Edit configuration.
2. Take note of:
   • IAM Identity Center sign-in URL
   • IAM Identity Center sign-out URL
   • Download the IAM Identity Center Certificate
3. Also take note of the:
   1. Web App URL - this will be the same URL as the Application ACS URL in the previous step without the /api/auth/login/callback part.
   2. Audience (Entity ID) from the previous step.
      
   3. AWS Access Portal URL - this is always https://<IdentityStoreId>.awsapps.com/start
      

Keep these details handy as you will need them in one of the upcoming steps.