...
You can create custom IAM roles that integrate with the Cornell Shibboleth so that access to those roles is granted according membership in an AD group. See Creating Custom Roles to use With Shibboleth.
Can I use a DOC (delegation of control) account or a Holding ID to login to AWS?
No. Our Shibboleth implementation does not work with DOC accounts of Holding IDs. (More info about DOC accounts: https://it.cornell.edu/cornellad/adminterms-and-accountconditions-guidelines.cornellad)
Networking
I deleted my "default" AWS VPC. How do I get it back?
...