For similar capabilities to Amazon Timestream for LiveAnalytics, consider Amazon Timestream for InfluxDB. It offers simplified data ingestion and single-digit millisecond query response times for real-time analytics. Learn more [here](https://docs.aws.amazon.com//timestream/latest/developerguide/timestream-for-influxdb.html).
# Setting up Timestream for LiveAnalytics JDBC single sign-on authentication with Microsoft Azure AD
Timestream for LiveAnalytics supports Timestream for LiveAnalytics JDBC single sign-on authentication with Microsoft Azure AD. To use Timestream for LiveAnalytics JDBC single sign-on authentication with Microsoft Azure AD, complete each of the sections listed below.
**Topics**
+ [Prerequisites](JDBC.withAzureAD.prereqs.md)
+ [Setting up Azure AD](JDBC.withAzureAD.setUp.md)
+ [Setting up IAM Identity Provider and roles in AWS](JDBC.withAzureAD.IAM.md)
# Prerequisites
Ensure that you have met the following prerequisites before using the Timestream for LiveAnalytics JDBC single sign-on authentication with Microsoft Azure AD:
+ [Admin permissions in AWS to create the identity provider and the roles](security-iam.md).
+ An Azure Active Directory account (Go to [ https://azure.microsoft.com/en-ca/services/active-directory/](https://azure.microsoft.com/en-ca/services/active-directory/) to create an account)
+ [Access to Amazon Timestream for LiveAnalytics](accessing.md).
# Setting up Azure AD
1. Sign in to Azure Portal
1. Choose **Azure Active Directory** in the list of Azure services. This will redirect to the Default Directory page.
1. Choose **Enterprise Applications** under the **Manage** section on the sidebar
1. Choose **\$1 New application**.
1. Find and select **Amazon Web Services**.
1. Choose **Single Sign-On** under the **Manage** section in the sidebar
1. Choose **SAML** as the single sign-on method
1. In the Basic SAML Configuration section, enter the following URL for both the Identifier and the Reply URL:
```
https://signin.aws.amazon.com/saml
```
1. Choose **Save**
1. Download the Federation Metadata XML in the SAML Signing Certificate section. This will be used when creating the IAM Identity Provider later
1. Return to the Default Directory page and choose **App registrations** under **Manage**.
1. Choose **Timestream for LiveAnalytics** from the **All Applications** section. The page will be redirected to the application's Overview page
**Note**
Note the Application (client) ID and the Directory (tenant) ID. These values are required for when creating a connection.
1. Choose **Certificates and Secrets**
1. Under **Client secrets**, create a new client secret with **\$1 New client secret**.
**Note**
Note the generated client secret, as this is required when creating a connection to Timestream for LiveAnalytics.
1. On the sidebar under **Manage**, select **API permissions**
1. In the **Configured permissions**, use **Add a permission** to grant Azure AD permission to sign in to Timestream for LiveAnalytics. Choose **Microsoft Graph** on the Request API permissions page.
1. Choose **Delegated permissions** and select the **User.Read **permission
1. Choose **Add permissions**
1. Choose **Grant admin consent for Default Directory**
# Setting up IAM Identity Provider and roles in AWS
Complete each section below to set up IAM for Timestream for LiveAnalytics JDBC single sign-on authentication with Microsoft Azure AD:
**Topics**
+ [Create a SAML Identity Provider](#JDBC.withAzureAD.IAM.SAML)
+ [Create an IAM role](#JDBC.withAzureAD.IAM.roleForIAM)
+ [Create an IAM policy](#JDBC.withAzureAD.IAM.policyForIAM)
+ [Provisioning](#JDBC.withAzureAD.IAM.provisioning)
## Create a SAML Identity Provider
To create a SAML Identity Provider for the Timestream for LiveAnalytics JDBC single sign-on authentication with Microsoft Azure AD, complete the following steps:
1. Sign in to the AWS Management Console
1. Choose **Services** and select **IAM** under Security, Identity, & Compliance
1. Choose **Identity providers** under Access management
1. Choose **Create Provider** and choose **SAML** as the provider type. Enter the **Provider Name**. This example will use AzureADProvider.
1. Upload the previously downloaded Federation Metadata XML file
1. Choose **Next**, then choose **Create**.
1. Upon completion, the page will be redirected back to the Identity providers page
## Create an IAM role
To create an IAM role for the Timestream for LiveAnalytics JDBC single sign-on authentication with Microsoft Azure AD, complete the following steps:
1. On the sidebar select **Roles** under Access management
1. Choose Create role
1. Choose **SAML 2.0 federation** as the trusted entity
1. Choose the **Azure AD provider**
1. Choose **Allow programmatic and AWS Management Console access**
1. Choose **Next: Permissions**
1. Attach permissions policies or continue to Next:Tags
1. Add optional tags or continue to Next:Review
1. Enter a Role name. This example will use AzureSAMLRole
1. Provide a role description
1. Choose **Create Role** to complete
## Create an IAM policy
To create an IAM policy for the Timestream for LiveAnalytics JDBC single sign-on authentication with Microsoft Azure AD complete the following steps:
1. On the sidebar, choose **Policies** under Access management
1. Choose **Create policy** and select the **JSON** tab
1. Add the following policy
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:ListRoles",
"iam:ListAccountAliases"
],
"Resource": "*"
}
]
}
```
------
1. Choose **Create policy**
1. Enter a policy name. This example will use TimestreamAccessPolicy.
1. Choose **Create Policy**
1. On the sidebar, choose **Roles** under Access management.
1. Choose the previously created **Azure AD role** and choose **Attach policies** under Permissions.
1. Select the previously created access policy.
## Provisioning
To provision the identity provider for Timestream for LiveAnalytics JDBC single sign-on authentication with Microsoft Azure AD, complete the following steps:
1. Go back to Azure Portal
1. Choose **Azure Active Directory** in the list of Azure services. This will redirect to the Default Directory page
1. Choose **Enterprise Applications** under the Manage section on the sidebar
1. Choose **Provisioning**
1. Choose **Automatic mode** for the Provisioning Method
1. Under Admin Credentials, enter your **AwsAccessKeyID** for clientsecret, and **SecretAccessKey** for Secret Token
1. Set the **Provisioning Status** to **On**
1. Choose **save**. This allows Azure AD to load the necessary IAM Roles
1. Once the Current cycle status is completed, choose **Users and groups** on the sidebar
1. Choose **\$1 Add user**
1. Choose the Azure AD user to provide access to Timestream for LiveAnalytics
1. Choose the IAM Azure AD role and the corresponding Azure Identity Provider created in AWS
1. Choose **Assign**