Back to Checks
aws

IAM SAML provider exists in the account

iam_check_saml_providers_sts
Service: iamSeverity: low
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

IAM SAML providers enable federated role assumption via STS AssumeRoleWithSAML.

This evaluates whether such providers exist in the account.

Prowler logoProwlerprowler-provider-aws

Risk

Without SAML federation, users rely on long-lived IAM keys. Compromised keys enable persistent API access, causing data exfiltration (C), unauthorized resource or policy changes (I), and difficult revocation. Lack of IdP controls (e.g., MFA, session limits) weakens accountability and access governance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_check_saml_providers_sts

Recommendation

Adopt SAML federation to issue short-lived STS credentials. Map users to roles with least privilege, enforce MFA at the IdP, and set conservative session durations. Retire IAM user access keys for interactive use and monitor role sessions as defense in depth. If federation isn't possible, tightly scope, rotate, and audit keys.

Remediation

CLI

aws iam create-saml-provider --name <SAML_PROVIDER_NAME> --saml-metadata-document file://<SAML_METADATA_XML_FILE>

Terraform

# Create an IAM SAML provider to satisfy the check
resource "aws_iam_saml_provider" "<example_resource_name>" {
  name                   = "<example_resource_name>"
  saml_metadata_document = file("<SAML_METADATA_XML_FILE>") # Critical: creates the SAML provider so the check passes
}

NativeIaC

# CloudFormation: create an IAM SAML provider to satisfy the check
Resources:
  <example_resource_name>:
    Type: AWS::IAM::SAMLProvider
    Properties:
      SamlMetadataDocument: "<SAML_METADATA_XML_CONTENT>"  # Critical: creates the SAML provider so the check passes
      Name: <example_resource_name>

Other

1In the AWS console, go to IAM
2In the left menu, select Identity providers
3Click Add provider
4Set Provider type to SAML
5Upload the SAML metadata XML and enter a Provider name
6Click Add provider

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_check_saml_providers_sts(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        if iam_client.saml_providers is not None:
            if not iam_client.saml_providers:
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=iam_client.saml_providers
                )
                report.resource_id = iam_client.audited_account
                report.resource_arn = iam_client.audited_account_arn
                report.region = iam_client.region
                report.status = "FAIL"
                report.status_extended = "No SAML Providers found."
                findings.append(report)

            else:
                for provider in iam_client.saml_providers.values():
                    report = Check_Report_AWS(
                        metadata=self.metadata(), resource=provider
                    )
                    report.region = iam_client.region
                    report.status = "PASS"
                    report.status_extended = (
                        f"SAML Provider {provider.name} has been found."
                    )
                    findings.append(report)

        return findings

References