CmdID / aws / aws iam

aws iam update-saml-provider

Updates the metadata document, SAML encryption settings, and private keys for an existing SAML provider. AWS CLI reference

1 example 5 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To update the metadata document for an existing SAML provider

The following update-saml-provider example updates the SAML provider in IAM whose ARN is arn:aws:iam::123456789012:saml-provider/SAMLADFS with a new SAML metadata document from the file SAMLMetaData.xml.

aws iam update-saml-provider --saml-metadata-document file://SAMLMetaData.xml --saml-provider-arn arn:aws:iam::123456789012:saml-provider/SAMLADFS

Identify

--saml-metadata-documentAn XML document generated by an identity provider (IdP) that supports SAML 2.0.

--saml-provider-arnThe Amazon Resource Name (ARN) of the SAML provider to update.

Contents of SAMLMetaData.xml:

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://adfs.example.com/adfs/services/trust">
    <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:KeyDescriptor use="signing">
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:X509Data>
                    <ds:X509Certificate>MIIC8DCCAdigAwIBAgIQEXAMPLE...</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </md:KeyDescriptor>
        <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://adfs.example.com/adfs/ls/"/>
        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://adfs.example.com/adfs/ls/"/>
    </md:IDPSSODescriptor>
</md:EntityDescriptor>

Its output

{
    "SAMLProviderArn": "arn:aws:iam::123456789012:saml-provider/SAMLADFS"
}

For more information, see Creating IAM SAML identity providers in the AWS IAM User Guide.

Options

5 in the AWS CLI reference

--add-private-keySpecifies the new private key from your external identity provider.

--assertion-encryption-modeSpecifies the encryption setting for the SAML provider.

--remove-private-keyThe Key ID of the private key to remove.

--saml-metadata-documentAn XML document generated by an identity provider (IdP) that supports SAML 2.0.

--saml-provider-arnThe Amazon Resource Name (ARN) of the SAML provider to update.