FAQs

What is SAML.to?

SAML.to allows GitHub Users and Repositories to assume AWS IAM Roles.

The differences between other similar services and SAML to is:

• We do not maintain a database of users, passwords or tokens, we rely on GitHub to do so

• Relationship of Users and Roles is maintained in a Configuration File checked into a GitHub Repository

• We offer a Developer Friendly CLI and GitHub actions for assuming roles.

Who can use SAML.to?

From individuals to enterprises. SAML.to works for anyone with one or more AWS Accounts, AWS Roles, GitHub Organizations, Teams and Users.

Can SAML.to be used at the same time with another service (Okta, JumpCloud, AWS SSO) for role assumptions?

Yes! Trust Relationships can have multiple statements, meaning they can trust multiple identity providers. When adding SAML.to, add another statement to the Trust Relationship, leaving the existing statements unmodified.

How do I validate that the saml-to.yml is correct?

Check out the Config Sync Action.

How is this different OpenID Connect in GitHub Actions?

The OpenID Connect feature for GitHub is exclusively for Repositories in GitHub Actions. SAML.to does this as well, in addition to:

• Allow Users to assume the same roles on their laptop with a developer friendly CLI

• Multiple Role Assumptions in a Single Action Run

Do I have to type the full Role ARN for a saml-to assume command?

You can use part of the role name.

How do I assume multiple roles at the same time?

Use Named Profiles

Have another question?

Submit an Issue on GitHub

or

Start a Discussion

or

Message us on Twitter