Answers: <p>AWS Cognito doesn't natively enforce SP-initiated SAML assertions for IdP-initiated logins. You can mitigate this by using custom AWS Lambda triggers (Pre-Token Generation) or AWS WAF rules to manage access flows. Here's a basic Terraform setup for SAML IdP:</p>
  <pre><code>resource &quot;aws_cognito_user_pool_identity_provider&quot; &quot;saml_idp&quot; {
    user_pool_id = aws_cognito_user_pool.example.id
    provider_name = &quot;YourSAMLProvider&quot;
    provider_type = &quot;SAML&quot;
    provider_details = {
      MetadataFile = &quot;saml-metadata.xml&quot;
    }
  }
  </code></pre>
  <p>Use Lambda for deeper control.</p>
  
Answers: CC BY-SA 4.0
Answers: 2024-09-11T06:41:30.577Z
Answers: I can control the setting it via the console though 
Answers: Ryan Pierce Williams
Answers: CC BY-SA 4.0
Answers: 2024-09-09T11:33:52.763Z
Answers: 2024-09-09T11:33:52.763Z
Answers: lostmarien
Body: <p>I am working on terraforming my AWS Cognito User Pools, but my google-fu is failing me. How do I configure my federated identity provider so that it's <code>IdP-initiated SAML sign-in</code> is assigned to <code>Require SP-initiated SAML assertions</code>?</p>
  
Tags: <terraform>
Title: Terraform | AWS Cognito | How to set Federated Identity Provider's `Idp-initiated SAML sign-in`?
UserDisplayName: Ryan Pierce Williams
ThreadText: # Terraform | AWS Cognito | How to set Federated Identity Provider's `Idp-initiated SAML sign-in`?
  
  (Asked by: username_0 on 2024-09-07)
  
  I am working on terraforming my AWS Cognito User Pools, but my google-fu is failing me. How do I configure my federated identity provider so that it's `IdP-initiated SAML sign-in` is assigned to `Require SP-initiated SAML assertions`?
  
  **Tags:** terraform
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2024-09-09. Score: 1
  
  AWS Cognito doesn't natively enforce SP-initiated SAML assertions for IdP-initiated logins. You can mitigate this by using custom AWS Lambda triggers (Pre-Token Generation) or AWS WAF rules to manage access flows. Here's a basic Terraform setup for SAML IdP:
  
  ```
  resource "aws_cognito_user_pool_identity_provider" "saml_idp" {
    user_pool_id = aws_cognito_user_pool.example.id
    provider_name = "YourSAMLProvider"
    provider_type = "SAML"
    provider_details = {
      MetadataFile = "saml-metadata.xml"
    }
  }
  
  ```
  
  Use Lambda for deeper control.
  
  > **Comments:**
  > **username_0**: I can control the setting it via the console though   
  
  ---
  
  