Configure AWS Identity

AWS Identity setup

Prepare the SCIM connection, check the installed connector, and validate users and groups before enabling provisioning.

The NIM AWS Identity REST connector targets AWS IAM Identity Center's SCIM interface. This is user/group provisioning, separate from AWS IAM access-key administration or assigning permission sets to AWS accounts. See the AWS SCIM overview.

1. Prepare AWS and record the connector versionDirect link to 1. Prepare AWS and record the connector version

Have the IAM Identity Center administrator review AWS automatic provisioning and enable it for the intended identity source.
Obtain the SCIM endpoint and access token from that instance. Keep the token in the connection's credential storage and plan for its expiration and rotation. Do not substitute an AWS access-key ID/secret pair.
Download the Tools4ever AWS Identity connector. Record the installed connector revision and compare it with the source findings below.
Use an isolated test user and group. Check whether another provisioning source already manages them before sending changes.

AWS requires populated user-name and name/display fields and recommends a stable, unique externalId. Match the SCIM user name with the identity used for sign-in. Follow the current AWS attribute requirements rather than assuming every field in the generic connector is accepted.

2. Check the installed connector's connection settingsDirect link to 2. Check the installed connector's connection settings

The public AWS Identity.json reviewed on October 24, 2026 has these settings:

Source setting	Value	What to check
Connection field `tenant_id`	Label SCIM endpoint:	Its base URL template is `https://{tenant_id}`. For this revision, the field must contain the endpoint host and path without a second `https://`. Preserve the AWS SCIM path.
Authentication selector	`aeries`	NIM's name for static key/bearer-header authentication; it does not mean this connection targets Aeries SIS. See REST authentication.
Request headers	`Authorization: Bearer {client_secret}` and `x-api-key: {client_secret}`	Enter the AWS access token in the Connection tab credential mapped to `client_secret`. Authentication supplies credential controls separately from the endpoint entry in `connection.items`. Confirm the installed form exposes the credential before continuing.
Connection test	`/ServiceProviderConfig`	After the authentication issue is resolved, test this endpoint using NIM's connection test.

Keep credentials in the connection

Do not enter a bearer token into the endpoint field or hardcode it into the connector JSON. If the installed form does not expose a credential field, confirm the connector/engine revision with the maintainer or Tools4ever Support. The declared endpoint-only connection.items array alone does not prove that the runtime credential control is missing.

Add the REST system using its installed system type, enter the endpoint and credential through its connection form, save, and test the connection. A failed test must be resolved before scheduling collection or writes.

3. Validate the first collectionDirect link to 3. Validate the first collection

Select only the tables needed for the test, initially Users and Groups.
Collect and load the system.
Inspect a known user and group. Confirm their SCIM id values and the user externalId used for matching. Display names are not reliable identity keys.
Compare the returned counts with the AWS source, including more than one page of results. The reviewed connector configures startIndex/count pagination. Current AWS ListUsers documentation does not support startIndex and requires a cursor for paginated requests. Obtain a revision compatible with AWS's current pagination before relying on a complete inventory; a successful first page is insufficient.
Test Members separately before using it for roles or access reconciliation.

The Members collection iterates Groups and requests /Users with a groups.value filter, which AWS lists as supported. That operation disables pagination in the reviewed connector; test a group with more than one page of members. Its source key is group_id; check that multiple members of one group are preserved rather than collapsed. One group ID alone does not uniquely identify a membership pair. Do not use incomplete membership data to generate removals.

4. Match identities and test one operationDirect link to 4. Match identities and test one operation

This is a bounded test procedure, not a verified connection export. Use the functions and inputs from the installed revision.

Goal	Function in the reviewed source	Required inputs
Create user	`UserCreate`	`userName`, `active`, `displayName`, `name_givenName`, `name_familyName`
Update user	`UserUpdate`	Existing SCIM `id`, plus intended changes
Create group	`GroupCreate`	`displayName`
Add membership	`MemberAdd`	`id` = SCIM user ID; `group_id` = SCIM group ID
Remove membership	`MemberRemove`	The same user/group ID pair

Define a relation between the authoritative person identifier and the collected user externalId, after proving the values match uniquely. Keep the target SCIM id available for update and membership actions.
Build a filter that selects exactly the disposable test record. Verify zero-match and duplicate-match cases before mapping the operation.
Supply only the supported attributes and run one intended change. A single-operation mapping test makes a real target change.
Inspect the result in IAM Identity Center, then recollect and compare NIM's data. Confirm the correct user/group pair, not just a successful HTTP response.
Test update and removal separately and document cleanup. Deletion and deactivation are different operations; agree on the lifecycle behavior before scheduling a job.

Do not enable broad deletion or membership reconciliation until authentication, identifier matching, pagination, and membership completeness have been verified. This guide does not claim an end-to-end tested service release or connector revision.

Troubleshoot connection and collectionDirect link to Troubleshoot connection and collection

Symptom	Next check
Connection form has no token field	Check the static-header authentication credential control and installed connector/engine revision. Do not put the token in the endpoint.
URL contains `https://https://` or loses the SCIM path	Compare the entered endpoint with that revision's base URL template.
HTTP 401/403	Check token validity, correct IAM Identity Center instance/endpoint, and the actual Authorization header without exposing the token in shared logs.
Only some users/groups appear	Check the connector's index-based pagination against AWS cursor requirements before changing filter criteria.
Membership collection fails or loses rows	Validate pagination and the membership key with multiple users in one group.

Retain the connector revision, redacted error/status, affected table, and expected/actual counts when contacting Support. Keep credentials out of screenshots and tickets.