{"action":"created","comment":{"url":"https://api.github.com/repos/auth0/docs/pulls/comments/46592349","id":46592349,"diff_hunk":"@@ -1,70 +1,104 @@\n-# How to Setup AWS to do Delegated Authentication with APIs\n+# Setup AWS for Delegated Authentication with APIs\n \n-In order to do delegated authentication with AWS APIs you have to create a **SAML Provider** and one or more **Roles**. This document explains how to do that.\n+To enable delegated authentication with AWS APIs, you must create a **SAML Provider** and one or more **Roles**.\n \n-## Creating the SAML Provider\n+## Create a SAML Provider\n \n-This is a one time setup\n+To create a SAML provider, follow these steps:\n \n-1. Go to the **AWS IAM Console** and click on **Identity Providers**\n+1. Go to the [AWS IAM Console](https://console.aws.amazon.com/iam/home#home). Click on **Identity Providers** in the left menu and then click **Create Provider**:\n \n   ![](/media/articles/aws-api-setup/aws-api-setup-1.png)\n \n-2. Click on **Create SAML Provider** and give it a name.\n+2. Select **SAML** as the **Provider Type** and enter a name for your provider:\n \n   ![](/media/articles/aws-api-setup/aws-api-setup-2.png)\n \n-<% if (account.userName) { %>\n-3. Download the metadata from <a href=\"https://${account.namespace}/samlp/metadata/${account.clientId}\">https://${account.namespace}/samlp/metadata/${account.clientId}</a> and upload it here.\n-<% } else { %>\n-3. Download the metadata from `https://${account.namespace}/samlp/metadata/${account.clientId}` and upload it here.\n-<% } %>\n+3. Download your metadata document from <% if (account.userName) { %><https://${account.namespace}/samlp/metadata/${account.clientId}><% } else { %>`https://${account.namespace}/samlp/metadata/${account.clientId}`<% } %>.\n+\n+  Click **Choose File** and browse to the metadata document you just downloaded. Click **Next Step**:\n \n   ![](/media/articles/aws-api-setup/aws-api-setup-3.png)\n \n-4. The SAML Provider was created. You can close the modal.\n+4. Verify your provider information and click **Create**:\n \n   ![](/media/articles/aws-api-setup/aws-api-setup-4.png)\n \n-## Creating Roles\n+## Create a Role\n \n-Now, you have to create a role that will have one or more policies associated. You can create as many roles as you want.\n+Now create a role with one or more associated policies. (You can create as many roles as required.)\n \n-1. Go to **Roles**.\n+1. On the AWS IAM Console, click on **Roles** in the left menu and then click **Create New Role**:\n \n   ![](/media/articles/aws-api-setup/aws-api-setup-5.png)\n \n-2. Click on **Create New Role** and give it an arbitrary name.\n+2. Provide a name for your new role and click **Next Step**:\n \n   ![](/media/articles/aws-api-setup/aws-api-setup-6.png)\n \n-3. Select or enter the following values.\n+3. Select **Role for Identity Provider Access**. Then select **Grant API access to SAML providers** and click **Next Step**:\n \n-  * **SAML Provider**: the provider you've just created\n-  * **Attribute**: `SAML:iss`\n-  * **Value**: `urn:${account.namespace}`\n+  ![](/media/articles/aws-api-setup/aws-api-setup-7.png)\n \n+4. Select or enter the following values:\n \n-  ![](/media/articles/aws-api-setup/aws-api-setup-7.png)\n+  * **SAML Provider**: the provider you just created\n+  * **Attribute**: `SAML:iss`\n+  * **Value**: `urn:${account.namespace}`\n \n-4. This is just a confirmation. Click on **Continue**.\n+  and click **Next Step**:\n \n   ![](/media/articles/aws-api-setup/aws-api-setup-8.png)\n \n-5. This is where you assign permissions to this role. In this example, we are creating a policy that give full access to the S3 resource `YOUR_BUCKET/<%= '${saml:sub}' %>`. This will be evaluated on runtime and replaced with the `user_id` of the logged in user.\n+5. On the Verify Role Trust page, accept the Policy Document as provided. Click **Next Step**:\n \n   ![](/media/articles/aws-api-setup/aws-api-setup-9.png)\n \n-  > For more information about what AWS APIs are supported: <http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_SpecificProducts.html>\n+6.  Skip the **Attach Policy** step for now. Click **Next Step**.\n \n-6. Confirm the creation of the new role.\n+7. Review the information and click **Create Role**:\n \n   ![](/media/articles/aws-api-setup/aws-api-setup-10.png)\n \n-7. Copy the **Role ARN** value. You will use this value later when calling the `/delegation` endpoint in Auth0.\n+## Create a Custom Policy\n+\n+In this example, you will create a policy that grants full access to the S3 resource: `YOUR_BUCKET/<%= '${saml:sub}' %>`. This will be evaluated at run-time and replaced with the `user_id` of the logged-in user.\n+\n+1. On the **Roles** page, select the role you just created.\n+\n+  On the **Permissions** tab under **Inline Policies**, click the link to create an inline policy:\n \n   ![](/media/articles/aws-api-setup/aws-api-setup-11.png)\n \n-8. Copy the **Principal ARN** value. You will use this value later when calling the `/delegation` endpoint in Auth0.\n+3. Name your policy and enter the following code in the **Policy Document** field:\n+\n+  ```\n+    {\n+      \"Version\": \"2012-10-17\",\n+      \"Statement\": [{\n+          \"Effect\": \"Allow\",\n+          \"Action\": [\n+            \"*\"\n+          ],\n+          \"Resource\": [\n+          \"arn:aws:s3:::YOUR_BUCKET/$[saml:sub}\",\n+          \"arn:aws:s3:::YOUR_BUCKET/$[saml:sub}/*\"]\n+      }]\n+    }\n+  ```\n+\n+4. Click **Validate Policy** to check your syntax, then click **Create Policy**.\n \n   ![](/media/articles/aws-api-setup/aws-api-setup-12.png)\n+\n+## Copy the ARN values\n+\n+1. From the summary page of the role you just created, copy the **Role ARN** value. You will use this value later when calling the `/delegation` endpoint in Auth0.\n+\n+  ![](/media/articles/aws-api-setup/aws-api-setup-13.png)\n+\n+2. From the summary page of the identity provider you created previously, copy the **Provider ARN** value. You will use this value later when calling the `/delegation` endpoint in Auth0.\n+\n+  ![](/media/articles/aws-api-setup/aws-api-setup-14.png)\n+\n+**NOTE:** For more information on supported AWS APIs, see: [AWS Services That Work with IAM](http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_SpecificProducts.html).","path":"articles/aws-api-setup.md","position":131,"original_position":131,"commit_id":"b28c2ea62dbe6ada5fac62997765753e66bc765d","original_commit_id":"38cf48b605dfdf70a2b38061f0651c7174d75a7e","user":{"login":"chriskeyser","id":1771508,"avatar_url":"https://avatars.githubusercontent.com/u/1771508?v=3","gravatar_id":"","url":"https://api.github.com/users/chriskeyser","html_url":"https://github.com/chriskeyser","followers_url":"https://api.github.com/users/chriskeyser/followers","following_url":"https://api.github.com/users/chriskeyser/following{/other_user}","gists_url":"https://api.github.com/users/chriskeyser/gists{/gist_id}","starred_url":"https://api.github.com/users/chriskeyser/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chriskeyser/subscriptions","organizations_url":"https://api.github.com/users/chriskeyser/orgs","repos_url":"https://api.github.com/users/chriskeyser/repos","events_url":"https://api.github.com/users/chriskeyser/events{/privacy}","received_events_url":"https://api.github.com/users/chriskeyser/received_events","type":"User","site_admin":false},"body":"I wouldn't worry about it, I think its fine at the end. The coverage now is almost 100%, it was more important a year ago when it was less complete.","created_at":"2015-12-03T18:43:23Z","updated_at":"2015-12-03T18:43:23Z","html_url":"https://github.com/auth0/docs/pull/562#discussion_r46592349","pull_request_url":"https://api.github.com/repos/auth0/docs/pulls/562","_links":{"self":{"href":"https://api.github.com/repos/auth0/docs/pulls/comments/46592349"},"html":{"href":"https://github.com/auth0/docs/pull/562#discussion_r46592349"},"pull_request":{"href":"https://api.github.com/repos/auth0/docs/pulls/562"}}},"pull_request":{"url":"https://api.github.com/repos/auth0/docs/pulls/562","id":50468719,"html_url":"https://github.com/auth0/docs/pull/562","diff_url":"https://github.com/auth0/docs/pull/562.diff","patch_url":"https://github.com/auth0/docs/pull/562.patch","issue_url":"https://api.github.com/repos/auth0/docs/issues/562","number":562,"state":"open","locked":false,"title":"Overall edits, all new screenshots, new policy steps, fixes 179","user":{"login":"Catografix","id":12396567,"avatar_url":"https://avatars.githubusercontent.com/u/12396567?v=3","gravatar_id":"","url":"https://api.github.com/users/Catografix","html_url":"https://github.com/Catografix","followers_url":"https://api.github.com/users/Catografix/followers","following_url":"https://api.github.com/users/Catografix/following{/other_user}","gists_url":"https://api.github.com/users/Catografix/gists{/gist_id}","starred_url":"https://api.github.com/users/Catografix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Catografix/subscriptions","organizations_url":"https://api.github.com/users/Catografix/orgs","repos_url":"https://api.github.com/users/Catografix/repos","events_url":"https://api.github.com/users/Catografix/events{/privacy}","received_events_url":"https://api.github.com/users/Catografix/received_events","type":"User","site_admin":false},"body":"fixes #179 ","created_at":"2015-11-12T03:45:00Z","updated_at":"2015-12-03T18:43:23Z","closed_at":null,"merged_at":null,"merge_commit_sha":"054bdb7ec797c4e110dba9a450c51fb06bb87701","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/auth0/docs/pulls/562/commits","review_comments_url":"https://api.github.com/repos/auth0/docs/pulls/562/comments","review_comment_url":"https://api.github.com/repos/auth0/docs/pulls/comments{/number}","comments_url":"https://api.github.com/repos/auth0/docs/issues/562/comments","statuses_url":"https://api.github.com/repos/auth0/docs/statuses/b28c2ea62dbe6ada5fac62997765753e66bc765d","head":{"label":"Catografix:aws-api-setup","ref":"aws-api-setup","sha":"b28c2ea62dbe6ada5fac62997765753e66bc765d","user":{"login":"Catografix","id":12396567,"avatar_url":"https://avatars.githubusercontent.com/u/12396567?v=3","gravatar_id":"","url":"https://api.github.com/users/Catografix","html_url":"https://github.com/Catografix","followers_url":"https://api.github.com/users/Catografix/followers","following_url":"https://api.github.com/users/Catografix/following{/other_user}","gists_url":"https://api.github.com/users/Catografix/gists{/gist_id}","starred_url":"https://api.github.com/users/Catografix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Catografix/subscriptions","organizations_url":"https://api.github.com/users/Catografix/orgs","repos_url":"https://api.github.com/users/Catografix/repos","events_url":"https://api.github.com/users/Catografix/events{/privacy}","received_events_url":"https://api.github.com/users/Catografix/received_events","type":"User","site_admin":false},"repo":{"id":39531206,"name":"docs","full_name":"Catografix/docs","owner":{"login":"Catografix","id":12396567,"avatar_url":"https://avatars.githubusercontent.com/u/12396567?v=3","gravatar_id":"","url":"https://api.github.com/users/Catografix","html_url":"https://github.com/Catografix","followers_url":"https://api.github.com/users/Catografix/followers","following_url":"https://api.github.com/users/Catografix/following{/other_user}","gists_url":"https://api.github.com/users/Catografix/gists{/gist_id}","starred_url":"https://api.github.com/users/Catografix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Catografix/subscriptions","organizations_url":"https://api.github.com/users/Catografix/orgs","repos_url":"https://api.github.com/users/Catografix/repos","events_url":"https://api.github.com/users/Catografix/events{/privacy}","received_events_url":"https://api.github.com/users/Catografix/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/Catografix/docs","description":"Auth0 documentation","fork":true,"url":"https://api.github.com/repos/Catografix/docs","forks_url":"https://api.github.com/repos/Catografix/docs/forks","keys_url":"https://api.github.com/repos/Catografix/docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Catografix/docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Catografix/docs/teams","hooks_url":"https://api.github.com/repos/Catografix/docs/hooks","issue_events_url":"https://api.github.com/repos/Catografix/docs/issues/events{/number}","events_url":"https://api.github.com/repos/Catografix/docs/events","assignees_url":"https://api.github.com/repos/Catografix/docs/assignees{/user}","branches_url":"https://api.github.com/repos/Catografix/docs/branches{/branch}","tags_url":"https://api.github.com/repos/Catografix/docs/tags","blobs_url":"https://api.github.com/repos/Catografix/docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Catografix/docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Catografix/docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/Catografix/docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Catografix/docs/statuses/{sha}","languages_url":"https://api.github.com/repos/Catografix/docs/languages","stargazers_url":"https://api.github.com/repos/Catografix/docs/stargazers","contributors_url":"https://api.github.com/repos/Catografix/docs/contributors","subscribers_url":"https://api.github.com/repos/Catografix/docs/subscribers","subscription_url":"https://api.github.com/repos/Catografix/docs/subscription","commits_url":"https://api.github.com/repos/Catografix/docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/Catografix/docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/Catografix/docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/Catografix/docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/Catografix/docs/contents/{+path}","compare_url":"https://api.github.com/repos/Catografix/docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Catografix/docs/merges","archive_url":"https://api.github.com/repos/Catografix/docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Catografix/docs/downloads","issues_url":"https://api.github.com/repos/Catografix/docs/issues{/number}","pulls_url":"https://api.github.com/repos/Catografix/docs/pulls{/number}","milestones_url":"https://api.github.com/repos/Catografix/docs/milestones{/number}","notifications_url":"https://api.github.com/repos/Catografix/docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Catografix/docs/labels{/name}","releases_url":"https://api.github.com/repos/Catografix/docs/releases{/id}","created_at":"2015-07-22T21:27:53Z","updated_at":"2015-07-22T21:27:54Z","pushed_at":"2015-12-02T23:07:57Z","git_url":"git://github.com/Catografix/docs.git","ssh_url":"git@github.com:Catografix/docs.git","clone_url":"https://github.com/Catografix/docs.git","svn_url":"https://github.com/Catografix/docs","homepage":null,"size":174675,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":0,"forks":1,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"auth0:master","ref":"master","sha":"705cc897db8a6fb184ace3731e9b8f6ce5713b42","user":{"login":"auth0","id":2824157,"avatar_url":"https://avatars.githubusercontent.com/u/2824157?v=3","gravatar_id":"","url":"https://api.github.com/users/auth0","html_url":"https://github.com/auth0","followers_url":"https://api.github.com/users/auth0/followers","following_url":"https://api.github.com/users/auth0/following{/other_user}","gists_url":"https://api.github.com/users/auth0/gists{/gist_id}","starred_url":"https://api.github.com/users/auth0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/auth0/subscriptions","organizations_url":"https://api.github.com/users/auth0/orgs","repos_url":"https://api.github.com/users/auth0/repos","events_url":"https://api.github.com/users/auth0/events{/privacy}","received_events_url":"https://api.github.com/users/auth0/received_events","type":"Organization","site_admin":false},"repo":{"id":33872272,"name":"docs","full_name":"auth0/docs","owner":{"login":"auth0","id":2824157,"avatar_url":"https://avatars.githubusercontent.com/u/2824157?v=3","gravatar_id":"","url":"https://api.github.com/users/auth0","html_url":"https://github.com/auth0","followers_url":"https://api.github.com/users/auth0/followers","following_url":"https://api.github.com/users/auth0/following{/other_user}","gists_url":"https://api.github.com/users/auth0/gists{/gist_id}","starred_url":"https://api.github.com/users/auth0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/auth0/subscriptions","organizations_url":"https://api.github.com/users/auth0/orgs","repos_url":"https://api.github.com/users/auth0/repos","events_url":"https://api.github.com/users/auth0/events{/privacy}","received_events_url":"https://api.github.com/users/auth0/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/auth0/docs","description":"Auth0 documentation","fork":false,"url":"https://api.github.com/repos/auth0/docs","forks_url":"https://api.github.com/repos/auth0/docs/forks","keys_url":"https://api.github.com/repos/auth0/docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/auth0/docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/auth0/docs/teams","hooks_url":"https://api.github.com/repos/auth0/docs/hooks","issue_events_url":"https://api.github.com/repos/auth0/docs/issues/events{/number}","events_url":"https://api.github.com/repos/auth0/docs/events","assignees_url":"https://api.github.com/repos/auth0/docs/assignees{/user}","branches_url":"https://api.github.com/repos/auth0/docs/branches{/branch}","tags_url":"https://api.github.com/repos/auth0/docs/tags","blobs_url":"https://api.github.com/repos/auth0/docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/auth0/docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/auth0/docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/auth0/docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/auth0/docs/statuses/{sha}","languages_url":"https://api.github.com/repos/auth0/docs/languages","stargazers_url":"https://api.github.com/repos/auth0/docs/stargazers","contributors_url":"https://api.github.com/repos/auth0/docs/contributors","subscribers_url":"https://api.github.com/repos/auth0/docs/subscribers","subscription_url":"https://api.github.com/repos/auth0/docs/subscription","commits_url":"https://api.github.com/repos/auth0/docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/auth0/docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/auth0/docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/auth0/docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/auth0/docs/contents/{+path}","compare_url":"https://api.github.com/repos/auth0/docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/auth0/docs/merges","archive_url":"https://api.github.com/repos/auth0/docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/auth0/docs/downloads","issues_url":"https://api.github.com/repos/auth0/docs/issues{/number}","pulls_url":"https://api.github.com/repos/auth0/docs/pulls{/number}","milestones_url":"https://api.github.com/repos/auth0/docs/milestones{/number}","notifications_url":"https://api.github.com/repos/auth0/docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/auth0/docs/labels{/name}","releases_url":"https://api.github.com/repos/auth0/docs/releases{/id}","created_at":"2015-04-13T14:09:26Z","updated_at":"2015-11-08T16:02:29Z","pushed_at":"2015-12-03T15:18:43Z","git_url":"git://github.com/auth0/docs.git","ssh_url":"git@github.com:auth0/docs.git","clone_url":"https://github.com/auth0/docs.git","svn_url":"https://github.com/auth0/docs","homepage":null,"size":175501,"stargazers_count":13,"watchers_count":13,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":88,"mirror_url":null,"open_issues_count":72,"forks":88,"open_issues":72,"watchers":13,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/auth0/docs/pulls/562"},"html":{"href":"https://github.com/auth0/docs/pull/562"},"issue":{"href":"https://api.github.com/repos/auth0/docs/issues/562"},"comments":{"href":"https://api.github.com/repos/auth0/docs/issues/562/comments"},"review_comments":{"href":"https://api.github.com/repos/auth0/docs/pulls/562/comments"},"review_comment":{"href":"https://api.github.com/repos/auth0/docs/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/auth0/docs/pulls/562/commits"},"statuses":{"href":"https://api.github.com/repos/auth0/docs/statuses/b28c2ea62dbe6ada5fac62997765753e66bc765d"}}}}