<p>AWS Cognito doesn't natively enforce SP-initiated SAML assertions for IdP-initiated logins. You can mitigate this by using custom AWS Lambda triggers (Pre-Token Generation) or AWS WAF rules to manage access flows. Here's a basic Terraform setup for SAML IdP:</p>
<pre><code>resource &quot;aws_cognito_user_pool_identity_provider&quot; &quot;saml_idp&quot; {
  user_pool_id = aws_cognito_user_pool.example.id
  provider_name = &quot;YourSAMLProvider&quot;
  provider_type = &quot;SAML&quot;
  provider_details = {
    MetadataFile = &quot;saml-metadata.xml&quot;
  }
}
</code></pre>
<p>Use Lambda for deeper control.</p>

CC BY-SA 4.0
2024-09-11T06:41:30.577Z
I can control the setting it via the console though 
Ryan Pierce Williams
CC BY-SA 4.0
2024-09-09T11:33:52.763Z
2024-09-09T11:33:52.763Z
lostmarien
<p>I am working on terraforming my AWS Cognito User Pools, but my google-fu is failing me. How do I configure my federated identity provider so that it's <code>IdP-initiated SAML sign-in</code> is assigned to <code>Require SP-initiated SAML assertions</code>?</p>

<terraform>
Terraform | AWS Cognito | How to set Federated Identity Provider's `Idp-initiated SAML sign-in`?
Ryan Pierce Williams
# Terraform | AWS Cognito | How to set Federated Identity Provider's `Idp-initiated SAML sign-in`?

(Asked by: username_0 on 2024-09-07)

I am working on terraforming my AWS Cognito User Pools, but my google-fu is failing me. How do I configure my federated identity provider so that it's `IdP-initiated SAML sign-in` is assigned to `Require SP-initiated SAML assertions`?

**Tags:** terraform


---

## 1 answers

### Answer by username_1 on 2024-09-09. Score: 1

AWS Cognito doesn't natively enforce SP-initiated SAML assertions for IdP-initiated logins. You can mitigate this by using custom AWS Lambda triggers (Pre-Token Generation) or AWS WAF rules to manage access flows. Here's a basic Terraform setup for SAML IdP:
resource "aws_cognito_user_pool_identity_provider" "saml_idp" {
  user_pool_id = aws_cognito_user_pool.example.id
  provider_name = "YourSAMLProvider"
  provider_type = "SAML"
  provider_details = {
    MetadataFile = "saml-metadata.xml"
  }
}

Use Lambda for deeper control.

> **Comments:**
> **username_0**: I can control the setting it via the console though   

---

