---
title: AWS IAM SAML Provider Created
description: Detects the creation of a new SAML Identity Provider (IdP) in AWS IAM. SAML providers enable federated authentication between AWS and external identity...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/persistence_iam_saml_provider_created
products:
  - Elastic Security
---

# AWS IAM SAML Provider Created
Detects the creation of a new SAML Identity Provider (IdP) in AWS IAM. SAML providers enable federated authentication
between AWS and external identity providers, allowing users to access AWS resources using credentials from the external
IdP. Adversaries who have gained administrative access may create rogue SAML providers to establish persistent,
federated access to AWS accounts that survives credential rotation. This technique allows attackers to assume roles and
access resources by forging SAML assertions from an IdP they control. Creating a SAML provider is a rare administrative
action that should be closely monitored and validated against authorized infrastructure changes.
**Rule type**: query
**Rule indices**:
- filebeat-*
- logs-aws.cloudtrail-*

**Rule Severity**: high
**Risk Score**: 73
**Runs every**: 
**Searches indices from**: `now-6m`
**Maximum alerts per execution**: 100
**References**:
- [[https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateSAMLProvider.html](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateSAMLProvider.html)](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateSAMLProvider.html)
- [[https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html)
- [[https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)

**Tags**:
- Domain: Cloud
- Data Source: AWS
- Data Source: Amazon Web Services
- Data Source: AWS IAM
- Use Case: Identity and Access Audit
- Tactic: Persistence
- Resources: Investigation Guide
- Noise: Low
- Performance: Fast
- Profile: Recommended
- Rule Type: Custom Query (KQL)
- Platform: AWS
- Data Source: AWS CloudTrail
- Service: AWS IAM

**Version**: 5
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating AWS IAM SAML Provider Created

SAML (Security Assertion Markup Language) providers in AWS IAM enable federated authentication, allowing users from external identity providers to access AWS resources without separate AWS credentials. Creating a SAML provider establishes a trust relationship between AWS and the external IdP.
This rule detects successful `CreateSAMLProvider` API calls. In most environments, SAML provider creation is extremely rare—typically only occurring during initial SSO setup or major infrastructure changes. An unauthorized SAML provider creation could enable an attacker to maintain persistent access by forging SAML assertions from an IdP they control.

### Possible investigation steps

- **Identify the actor**
  - Review `aws.cloudtrail.user_identity.arn` to determine who created the SAML provider.
  - Verify whether this principal is authorized to manage identity federation.
- **Review the SAML provider details**
  - Examine `aws.cloudtrail.request_parameters` for the SAML provider name and metadata document.
  - Identify the external IdP URL and signing certificate in the metadata.
- **Validate business justification**
  - Confirm with identity management or platform teams whether this aligns with planned SSO integration.
  - Check for related change tickets or infrastructure-as-code deployments.
- **Check for follow-on activity**
  - Search for `CreateRole` or `UpdateAssumeRolePolicy` calls that reference the new SAML provider.
  - Look for `AssumeRoleWithSAML` calls using the newly created provider.
- **Correlate with other suspicious activity**
  - Check for preceding privilege escalation or credential access events.
  - Look for other persistence mechanisms being established concurrently.


### False positive analysis

- **Planned SSO integration**
  - SAML providers are created during initial setup of identity federation with Okta, Azure AD, or other IdPs.
  - Validate against documented SSO integration projects.
- **Infrastructure-as-code deployments**
  - Terraform, CloudFormation, or other IaC tools may create SAML providers as part of automated deployments.
  - Confirm via CI/CD logs.


### Response and remediation

- **Immediate containment**
  - If unauthorized, delete the SAML provider using `DeleteSAMLProvider`.
  - Review and remove any IAM roles that trust the rogue provider.
- **Investigation**
  - Audit CloudTrail for any `AssumeRoleWithSAML` calls using this provider.
  - Review all IAM roles with SAML trust relationships.
- **Hardening**
  - Restrict `iam:CreateSAMLProvider` permissions to a limited set of administrative roles.
  - Implement SCPs to control SAML provider creation in member accounts.
  - Enable AWS Config rules to monitor identity provider configurations.


### Additional information

- **[AWS IAM SAML Providers Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html)**
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)**
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)**


## Rule Query

```kuery
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "iam.amazonaws.com"
    and event.action: "CreateSAMLProvider"
    and event.outcome: "success"
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Persistence
  - Id: TA0003
  - Reference URL: [[https://attack.mitre.org/tactics/TA0003/](https://attack.mitre.org/tactics/TA0003/)](https://attack.mitre.org/tactics/TA0003/)
- Technique:
  - Name: Valid Accounts
  - Id: T1078
  - Reference URL: [[https://attack.mitre.org/techniques/T1078/](https://attack.mitre.org/techniques/T1078/)](https://attack.mitre.org/techniques/T1078/)
- Sub Technique:
  - Name: Cloud Accounts
  - Id: T1078.004
  - Reference URL: [[https://attack.mitre.org/techniques/T1078/004/](https://attack.mitre.org/techniques/T1078/004/)](https://attack.mitre.org/techniques/T1078/004/)
- Technique:
  - Name: Account Manipulation
  - Id: T1098
  - Reference URL: [[https://attack.mitre.org/techniques/T1098/](https://attack.mitre.org/techniques/T1098/)](https://attack.mitre.org/techniques/T1098/)
- Sub Technique:
  - Name: Additional Cloud Credentials
  - Id: T1098.001
  - Reference URL: [[https://attack.mitre.org/techniques/T1098/001/](https://attack.mitre.org/techniques/T1098/001/)](https://attack.mitre.org/techniques/T1098/001/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Privilege Escalation
  - Id: TA0004
  - Reference URL: [[https://attack.mitre.org/tactics/TA0004/](https://attack.mitre.org/tactics/TA0004/)](https://attack.mitre.org/tactics/TA0004/)
- Technique:
  - Name: Domain or Tenant Policy Modification
  - Id: T1484
  - Reference URL: [[https://attack.mitre.org/techniques/T1484/](https://attack.mitre.org/techniques/T1484/)](https://attack.mitre.org/techniques/T1484/)
- Sub Technique:
  - Name: Trust Modification
  - Id: T1484.002
  - Reference URL: [[https://attack.mitre.org/techniques/T1484/002/](https://attack.mitre.org/techniques/T1484/002/)](https://attack.mitre.org/techniques/T1484/002/)