Implementation of Just-in-Time (JIT) privileged access to AWS using Microsoft Entra Privileged Identity Management (PIM) integrated with AWS IAM Identity Center.
Based on AWS Security Blog: Implementing just-in-time privileged access to AWS
| Diagram | Description |
|---|---|
| Data Flow | Step-by-step access flow |
| Session Timeline | Timeline from request to revocation |
| Multi-Account | AWS Organization setup |
| Security Controls | Security layers and monitoring |
- ✅ Time-bound access (1-24 hours)
- ✅ Approval workflow (optional)
- ✅ MFA enforcement
- ✅ Justification tracking
- ✅ Audit logging
- ✅ Automatic provisioning via SCIM
- ✅ Permissions boundary for privilege escalation prevention
- ✅ CloudWatch monitoring (optional)
- ✅ Terraform automation
| Component | Requirement |
|---|---|
| AWS | Organization instance of IAM Identity Center |
| Azure | Entra ID P1 or P2 licensing |
| Integration | SAML + SCIM configured |
| Terraform | >= 1.6 |
| Setting | Default | Range | Notes |
|---|---|---|---|
| AWS access portal session | 8 hours | 15 mins - 90 days | User interactive session |
| Permission set session | 1 hour | 1 - 12 hours | Per permission set |
| PIM activation duration | 8 hours | 30 mins - 24 hours | Per group |
⚠️ Important: Active sessions are NOT terminated when PIM expires. Potential access window = PIM duration + sync delay (~10 mins) + session duration.
- Configure SAML & SCIM
- Create Security Groups
- Configure Permission Sets
- Enable PIM for Groups
- Test & Validate
cd terraform
cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars with your values
terraform init
terraform plan
terraform apply| Document | Description |
|---|---|
| Architecture | Solution architecture and data flow |
| Best Practices | Recommended configurations |
| Security Best Practices | Security guidelines |
| Security Checklist | Compliance checklist |
| Troubleshooting | Common issues and solutions |
- Nested groups not supported with SCIM
- Dynamic groups supported but don't flatten nested groups
- Attribute removal in Entra doesn't sync to IAM Identity Center
- SCIM sync can take 2-40 minutes depending on load
- Multi-value attributes (multiple emails, phones) not supported
- SCIM token expires after 1 year - rotate before expiration
- AWS Blog: Implementing JIT privileged access
- Configure SAML and SCIM with Microsoft Entra ID
- IAM Identity Center User Guide
Contributions are welcome! Please read CONTRIBUTING.md for details.
This project is licensed under the MIT License - see the LICENSE file for details.
- AWS Security Blog team for the original architecture
- Microsoft Entra documentation team