In short: Cisco Duo protects AWS through Duo Single Sign-On, which acts as a SAML identity provider for either AWS IAM Identity Center or direct AWS IAM role federation. Users sign in through Duo with MFA and device checks before reaching the AWS Management Console. Duo Unix adds MFA to SSH on Linux instances such as Amazon Linux.
Two ways to connect Duo SSO to AWS
Duo offers two pre-built AWS applications in Duo Single Sign-On, both included from Duo Essentials:
| AWS IAM Identity Center | AWS IAM (role federation) | |
|---|---|---|
| Best for | Several AWS accounts managed centrally through AWS Organizations | A single account, or a few accounts with simple role access |
| Where access is defined | Permission sets assigned in IAM Identity Center | IAM roles in each account, mapped to Duo groups |
| User provisioning | Yes, SCIM 2.0 from Duo, covering users and groups | No separate provisioning |
| AWS CLI | Supported through aws configure sso and aws sso login | Duo recommends Identity Center for AWS CLI v2 |
| Sign-in flow | From the AWS access portal or Duo Central | Started from Duo Central or the Duo SSO login URL (identity provider initiated only) |
For most organisations with more than one AWS account, IAM Identity Center is the cleaner long-term choice. Direct IAM federation remains useful for a single account or where you need tight control of which role each Duo group can assume.
How role mapping works with AWS IAM federation
With the AWS IAM application, Duo tells AWS which role a user may assume:
- In AWS IAM, create a SAML identity provider and upload the metadata file from the Duo application
- Create one or more IAM roles that trust that SAML provider and attach the permissions each role needs
- In the Duo application, enter the AWS account number, the provider name and each role name, and choose the Duo groups whose members should receive that role
- Users who belong to more than one mapped group choose which role to assume when they sign in
You can also set a session duration between 15 minutes and 12 hours, as long as it does not exceed the maximum session duration set on the IAM role. The application supports standard AWS Regions, AWS China Regions and AWS GovCloud. It does not support extra custom SAML attributes; if you need those, Duo suggests its generic SAML application instead.
AWS IAM Identity Center with Duo
With IAM Identity Center, Duo SSO is set as the external identity provider by exchanging metadata between the Duo Admin Panel and the AWS console. Access to accounts and roles is then managed in AWS through permission sets assigned to users and groups.
Duo can provision those users and groups automatically using SCIM 2.0 with a bearer token from AWS. Points to know:
- The provisioned username must be an email address
- Deprovisioning deactivates users by default, and can be switched to deletion
- You can provision selected groups, or reuse the groups already allowed to use the application
- Duo's documentation notes that the same provisioning also covers access to AWS Client VPN and Amazon Redshift through Identity Center
Developers using the AWS CLI sign in with aws sso login, which sends them through Duo in the browser rather than relying on long-lived access keys.
MFA for SSH to EC2 Linux instances
Console access is only half the picture. Duo Unix adds Duo to SSH and local logins on Linux through a PAM module (pam_duo), and Duo lists Amazon Linux among the distributions it has tested, alongside Red Hat, CentOS, Fedora, Debian and Ubuntu.
- It works alongside SSH keys: with OpenSSH you can require a public key first and then a Duo prompt
- Factors include Duo Push, Verified Duo Push with a numeric code (Duo Unix 2.2.0 and later, Essentials and above), Duo Mobile passcodes, SMS passcodes, hardware token passcodes, phone call and bypass codes
- By default Duo Unix fails safe, allowing access when a service or configuration error stops Duo authentication; set the fail mode to secure for production servers
- Instances need outbound HTTPS (TCP 443, TLS 1.2 or later) to Duo; Duo advises against firewall rules based on its IP addresses because they can change
For private instances you would rather not expose at all, Duo Network Gateway in Duo Premier can publish SSH and internal web apps without a VPN.
Good practice for AWS sign-in
- Protect the root user separately: the AWS account root user signs in with its own email and password and is not covered by federation, so give it AWS's own MFA and lock the credentials away
- Use phishing-resistant factors for admins: require passkeys or security keys for the Duo groups mapped to administrator roles
- Check devices: device trust policies can stop console access from unmanaged or out-of-date laptops
- Keep a break-glass path: document how you would reach AWS if your identity provider were unavailable
How we help
We design the right AWS integration for your account structure, map Duo groups to roles or permission sets, set up provisioning, add Duo Unix to Linux instances with safe fail modes, and test everything with a pilot group before enforcement. Contact us to protect your AWS estate with Duo.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Cisco Duo work with AWS?
Yes. Duo Single Sign-On has pre-built applications for AWS IAM Identity Center and for AWS IAM role federation, so users sign in to the AWS Management Console through Duo with MFA and device checks. Duo Unix adds MFA to SSH on Linux instances.
Should I use AWS IAM Identity Center or IAM federation with Duo?
IAM Identity Center usually suits organisations with several AWS accounts, because access is managed centrally with permission sets and Duo can provision users with SCIM. Direct IAM federation suits a single account with a few roles mapped to Duo groups.
Can Duo protect the AWS CLI?
Yes, through IAM Identity Center. Users run aws configure sso and aws sso login, which opens a browser sign-in through Duo. Duo recommends the Identity Center application for AWS CLI v2.
Does Duo protect the AWS root user?
No. The AWS root user signs in with its own email address and password and is not covered by SAML federation. Protect it with AWS's own MFA and keep its use to a minimum.
Which Duo edition do I need for AWS?
The AWS SSO integrations use Duo Single Sign-On, which is included in Duo Essentials, Advantage and Premier. Duo Network Gateway for VPN-less access to private resources needs Duo Premier.