Enable External SSO

Question

Hello Team,

We are trying to enable GSUITE SSO for accessing the account using the below-given doc.
https://aws.amazon.com/blogs/security/how-to-use-g-suite-as-external-identity-provider-aws-sso/

In the doc, I see that all the users need to be recreated and permissions have to be given again.

The major question I have for you is, after we enable SSO via Gsuite, whether our users will be able to continue login via normal username and password?

Can someone point me to that exact settings?

Our main goal is to enable SSO via Gsuite but not enforce it, slowly we will move all users to sso login and later disable password login.

Thanks in advance.

Answer

Once you enable SSO via G Suite as described in the article you linked, users will not be able to log in to AWS SSO using a normal username and password. To allow users to continue logging in with their username and password, you will need to set up an additional authentication method, such as IAM users and roles, for AWS SSO. To disable password login for AWS SSO, you will need to remove the password-based authentication method from AWS SSO.

Enable External SSO

Relevant content