Okta
Purpose
Ingests Okta users, groups and memberships, applications, admin roles, MFA factors, and trusted origins.
tip
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
Required Fields
| Field | Secret? | Description |
|---|---|---|
okta_org_id |
No | Your Okta org subdomain, e.g. acme for https://acme.okta.com |
okta_api_key |
Yes | Okta SSWS API token |
okta_saml_role_regex |
No | Regex mapping Okta groups to AWS roles (default provided) |
Setup Steps
- Create a service account (e.g.
svc_cartography). - Give it Read-only Admin or a custom read-only role with visibility into Users, Groups, Apps, Roles, Factors, and Trusted Origins.
- In Okta Admin Console → Security → API → Tokens → Create token and copy the value.
- In SubImage, fill in:
okta_org_id— your org subdomainokta_api_key— the token (or its AWS Secret ARN)okta_saml_role_regex— leave default unless you use a custom group naming scheme
- Save the module.
Notes
- Okta expires tokens after 30 days of inactivity.
- Authentication is SSWS API token only — OAuth is not supported.