very informative. Thank you

Thank you for taking the time to share this with us. That's mostly reproducible, except for a few *crucial* gotchas that I wish were more stressed out. I wish that you insisted more on the prep work provisioning part. 1. the catchall group MUST be at the root level of AD, or the Add Users & Groups feature will NOT find it. I've tried different path separator and forms, but only root-level will work. 2. The groups that provisioned users belong to can't be of "Local" scope. They have to be at least "Global". 3. In my case, it's not until I assigned the AWS Account permission sets that the Groups appeared in the AWS sync panel. Before that, only users appeared. 4. There is still a gotcha that resolved by itself overnight, is that initially, my synced users appear with Status = Disabled. Overnight they switched to "Enabled".