Create AWS IAM users based on e-mail domain

Question

I am setting up an AWS Account, the account will be used by an organization of employees for EC2 use/experimentation. Obviously, I do not want to distribute the root login info or set up one single IAM user for everyone to use. Unfortunately, I do not have the time to manage creating individual IAM users for everyone on a regular basis.

So, is there a way to auto-create IAM users based on a given email's domain on their first login attempt? The users should have read-only roles to begin, then an Administrator could give more roles as needed to each user. I am open to suggestions, perhaps lambda functions or linking to an identity provider?

Keep in mind that these new IAM users need to have access to the AWS Management Console, this is not necessarily intended for login to applications hosted on AWS.

Update:

Moving forward using this AWS Management Console Federation Proxy Sample found in Amazon's code reference, using with Microsoft Exchange hosted email.

Answer 1

If your existing identity provider supports SAML2 Federation, you can set it up to login to the AWS Management Console.

For more details refer Enabling SAML 2.0 Federated Users to Access the AWS Management Console.

Else you can implement a custom Federation Broker to return an URL to the user, after they authenticate with their corporate credentials.

For more details refer Creating a URL that Enables Federated Users to Access the AWS Management Console (Custom Federation Broker).