Configuring for Session Invalidation

The following prerequisites are required on the AWS side to enable Session Invalidation feature:

• Each Integration Role in the AWS environment must be updated to allow the following additional API actions: 

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": [
          "iam:CreatePolicy",
          "iam:DeletePolicy",
          "iam:CreatePolicyVersion",
          "iam:DeletePolicyVersion",
          "iam:GetPolicy",
          "iam:GetPolicyVersion",
          "iam:ListPolicyVersions"
        ],
        "Effect": "Allow",
        "Resource": "arn:aws:iam::*:policy/britive/managed/*",
      }
    ]
  }

• Each role that is marked for use by Britive (trusts the Britive identity provider) must have its trust policy updated to reflect the following: 

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Principal": {
                  "Federated": "arn:aws:iam::<account>:saml-provider/<britive idp>"
              },
              "Action": [
                  "sts:AssumeRoleWithSAML",
                  "sts:SetSourceIdentity",
                  "sts:TagSession"
              ],
              "Condition": {
                  "StringEquals": {
                      "SAML:aud": "https://signin.aws.amazon.com/saml"
                  }
              }
          }
      ]
  }

• It is recommended that customers apply a Service Control Policy (SCP) in the management account of AWS organization which restricts access to the Britive-managed IAM policies so that only the Britive integration role can update those policies.

  {
   "Effect": "Deny",
   "Actions": "*",
   "Resource": "arn:aws:iam::*:policy/britive/managed/*",
   "Condition": {
    "StringNotLike": {
     "aws:PrincipalArn": "arn:aws:iam::*:role/<britive integration role name>"
    }
   }
  }