AWS Control Tower SCIM

Hi, @WillF.53640 (Customer)​ 

Thank you for posting on our Community page!

Here’s an important article on your use case:

https://support-okta.login.adsbillinghub.com/help/s/article/Error-pushing-groups-to-application?language=en_US

However, I would suggest visiting our Dev forum and ask these types of questions there to fully benefit from their expertise.

Thank you for reaching out to our Community and have a great day!

--

Join the discussion for the Ask Me Anything online event on May 23, 2024 with Okta Tactical Edge Product Experts

Updating this response for ease of access and reference: 

Overview

Group Push fails after group creation because AWS rejects the group payload during deserialization due to a schema mismatch, or because the configuration uses the same Okta group for both user assignment and Group Push. Resolve this by using a dedicated push group, confirming the correct System for Cross-domain Identity Management (SCIM) application template, and recreating the push mapping. The group appears in AWS and indicates creation via SCIM, but displays an error and fails to provision users.

Changes to the Group push mapping for the group awsssoPowerUsers could not take effect due to error: Error while creating user group awsssoPowerUsers: Exception in deserializing the Group Json String. Error message=Resource 'Group' is malformed: 'urn:scim:schemas:core:1.0' must be declared in the schemas attribute., json string={"id":"14b854c8-00d1-706e-055b-728557f8828a","meta":{"resourceType":"Group","created":"2024-05-10T18:24:17Z","lastModified":"2024-05-10T18:24:17Z"},"schemas":["urn:ietf:params:scim:schemas:core:2.0:Grou

Applies To

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Amazon Web Services (AWS) Control Tower
• System for Cross-domain Identity Management (SCIM)
• Group Push

Cause

AWS rejects the group payload during deserialization because the expected schema declaration does not match the schema Uniform Resource Name (URN) Okta sends. The group creation succeeds, but the subsequent membership update fails. Additionally, using the same Okta group for both user assignment and Group Push causes failures, as Okta does not support this configuration for AWS.

Solution

How is the AWS Group Push error resolved?

Create a dedicated Okta group for Group Push, remove the existing mapping, verify the AWS Identity and Access Management (IAM) Identity Center integration uses the SCIM 2.0 configuration, and add the new group under the Push Groups tab.

1. Create a new Okta group dedicated only to Group Push, separate from any group assigned to the AWS application.
2. Add the required users to this group.
3. Remove the existing Group Push mapping for the affected group from the application's Push Groups tab.
4. Delete the group that AWS created during the previous attempt.
5. Confirm that the application is the AWS IAM Identity Center integration from the Okta Integration Network (OIN) and that provisioning uses the SCIM 2.0 configuration.
6. Add the new dedicated group under Push Groups.
7. Select the option to push group membership and run the push.
8. Review the System Log in the Okta Admin Console for any remaining group push events.
9. Open a case with Okta Support and include the full System Log event if the error persists.