
This article demonstrates how to use PowerShell and SCIM to automatically synchronize Active Directory users and groups to AWS IAM Identity Center via a serverless AWS Fargate container that runs every 12 hours.


<div><p>This article explains how to synchronize Active Directory users and groups to AWS IAM Identity Center using SCIM and PowerShell, addressing the limitation that ADFS does not support SCIM.</p><ul><li>Uses PowerShell to sync AD users/groups via IAM IDC SCIM RESTful API</li><li>Implements serverless architecture with AWS Fargate running scheduled container tasks</li><li>Stores AD and SCIM credentials securely in AWS Secrets Manager</li><li>Stores configuration parameters in AWS Systems Manager Parameter Store</li><li>PowerShell script runs every 12 hours to create/update users and groups</li><li>Links AD users to IAM IDC users via SID stored as externalId</li><li>Disables IAM IDC users when disabled in AD</li><li>Does not delete users or groups, only creates and updates</li><li>Solution uses Windows containers on Fargate for familiar DevOps tooling</li></ul><p>This approach enables organizations with ADFS implementations to automatically synchronize their on-premises AD with AWS IAM Identity Center without requiring SCIM support from ADFS.</p></div>


Related articles