In this video,
you'll see how to set up Amazon Managed Grafana with Okta.
With this capability,
you can establish direct federation from Okta
to Amazon Managed Grafana,
easily configure and test
Security Assertion Markup Language, or SAML authentication,
and implement Just-in-Time, or JIT user provisioning.
To get started,
let's create a workspace in Amazon Managed Grafana.
We'll use the workspace to demonstrate using Okta
as an identify provider.
We'll use SAML as the authentication method.
For this example, we'll grant access to all data sources.
Notice that further input will be needed
after the workspace is created
to complete the SAML configuration.
Let's create the workspace.
The creation process takes up to five minutes.
In the meantime,
we'll go to Okta and set up the integration.
Let's find Amazon Managed Grafana
in the application catalog and add it.
For the purposes of this example,
we'll retain the default visibility settings.
Now that we've created the application,
let's configure the sign-on settings.
This is where we'll configure the application
to work with our Amazon Managed Grafana workspace.
We'll need to provide information about our workspace here.
Let's go back to the workspace to locate what we need.
As you can see, the workspace has finished creating.
Let's complete the SAML setup.
Every Amazon Managed Grafana workspace
has a unique namespace and a region where it's deployed.
Let's copy the workspace ID from the workspace URL
and return to Okta.
We'll paste in the namespace
then go back to the workspace to copy the region.
Next, we'll copy this link
for our identity provider metadata
and paste it into Amazon Managed Grafana.
Now we'll set up an administrator.
Since we're using JIT provisioning
and relying on a SAML assertion from Okta,
we need to tell Amazon Managed Grafana
the assertion attribute role and admin role values
that will identify a user as an administrator.
For the purposes of this example,
we'll use department as the assertion attribute role.
We'll specify SDE as the admin role value.
Let's return to Okta to configure attributes there.
This part of the process is optional
and specifies how an Okta attribute
will be sent in the assertion.
In this case, Okta will send the value user.department
in the SAML assertion as department.
You can add more custom attributes if you wish.
In this case, let's move on and save the configuration.
Next, let's assign this application to a user.
We'll assign the application to the first user on this list.
As you can see, the user was successfully assigned.
This individual now has the ability
to use Amazon Managed Grafana.
Now that we've assigned this user,
let's look at the user's attributes.
As you can see,
one of the attributes of this user is department,
and it's populated with SDE.
Based on the way we've configured Amazon Managed Grafana,
this user should be granted the administrator role.
Next, we'll return to Amazon Managed Grafana
and save our SAML configuration there.
Now that the configuration is complete,
let's see how it looks from the user's perspective.
We'll open a tab in a private window to log in as the user.
As you can see, we are prompted to sign in with SAML.
Let's sign in.
We've successfully logged in.
Let's check our user configuration
to make sure we're logged in as an administrator.
As you can see, we are logged in as an administrator.
If the attribute hadn't matched,
we would have logged in as a viewer only,
and this page would not be visible.
You've just seen how to set up
Amazon Managed Grafana with Okta.
You can learn more about this topic
in the description and links for this video.
Thanks for watching.
Now it's your turn to try.