AWS Identity Providers and Federation Explained – SAP-C02 Study Guide

Purpose of This Lesson

Identity federation allows users to authenticate through an existing identity provider and access AWS resources without maintaining a separate AWS username and password for every user. AWS commonly uses federation with on-premises Active Directory, enterprise identity providers, social login providers, and web or mobile applications.

The central security pattern is to exchange a trusted authentication assertion or token for temporary AWS security credentials. Those credentials are then used to access AWS services such as Amazon DynamoDB.

Key Concepts

Identity providers and federation

An identity provider (IdP) authenticates users and provides information about their identity. Examples include:

• On-premises Microsoft Active Directory
• Azure AD or another SAML 2.0-compatible enterprise provider
• Apple, Google, or Facebook
• Amazon Cognito user pools

Federation connects that external identity source to AWS. The user authenticates with the external provider, and AWS Security Token Service (AWS STS) issues temporary credentials based on the trusted assertion or token.

This avoids embedding long-term AWS access keys in applications and reduces the need to duplicate user accounts in AWS.

SAML federation with AWS STS

SAML, or Security Assertion Markup Language, is commonly used for workforce federation from enterprise identity systems.

A typical flow is:

1. A user authenticates against an external directory such as on-premises Active Directory.
2. An identity provider, such as Active Directory Federation Services, validates the authentication and produces a SAML assertion.
3. The assertion is sent to AWS STS through AssumeRoleWithSAML.
4. AWS STS returns temporary security credentials.
5. The user or application uses those credentials to access permitted AWS resources.

The SAML assertion confirms the user’s authenticated identity. IAM roles and their policies determine what the resulting temporary credentials can do in AWS.

Web identity federation

Web identity federation is designed for applications whose users authenticate through a web identity provider. Supported providers can include social identity providers such as Apple, Google, and Facebook, as well as OpenID Connect-compatible providers.

The flow uses:

1. User authentication with the external web identity provider
2. A token presented to AWS STS
3. The AssumeRoleWithWebIdentity API operation
4. Temporary AWS credentials returned to the application

For most web and mobile application scenarios, Amazon Cognito is generally the preferred abstraction instead of integrating an application directly with web identity federation.

IAM Identity Center

AWS IAM Identity Center, formerly called AWS Single Sign-On (AWS SSO), provides centralized workforce access and single sign-on.

It can use several identity sources:

• The built-in IAM Identity Center directory
• Active Directory through AWS Directory Service options such as AD Connector or AWS Managed Microsoft AD
• An external identity provider using SAML 2.0

IAM Identity Center integrates with AWS Organizations, allowing administrators to assign users and groups access to multiple AWS accounts through permission sets. It also supports integrations with many business applications.

IAM Identity Center is primarily a workforce access and centralized account-access solution. It is distinct from Cognito, which is intended mainly for application users.

Amazon Cognito

Amazon Cognito is commonly used to authenticate users of web and mobile applications and provide those applications with controlled access to AWS services.

Cognito has two major components:

• User pools: User directories that authenticate users. A user pool can store user accounts directly or federate authentication to providers such as Apple, Google, or Facebook.
• Identity pools: Exchange authenticated user tokens for temporary AWS credentials by invoking the equivalent web identity federation flow.

A typical Cognito flow is:

1. The application authenticates a user through a Cognito user pool or a configured social provider.
2. The application receives a JSON Web Token (JWT).
3. The JWT is presented to a Cognito identity pool.
4. The identity pool obtains temporary credentials from AWS STS using AssumeRoleWithWebIdentity.
5. The application uses those credentials to access permitted AWS resources, such as a DynamoDB table.

User pools and identity pools solve different problems: user pools authenticate users, while identity pools provide temporary AWS credentials for access to AWS resources.

Architecture Decision Guide

Requirement	Recommended approach	Credential or protocol flow	Typical audience
Workforce users need access to AWS accounts from an enterprise directory	IAM Identity Center	SAML 2.0 or directory integration; permission sets provide account access	Employees, administrators, contractors
Direct enterprise federation into AWS using an existing SAML provider	SAML federation with IAM roles and AWS STS	AssumeRoleWithSAML	Workforce users and enterprise applications
Application users authenticate with a social or OIDC provider and need temporary AWS access	Amazon Cognito	User pool token to identity pool, then web identity credentials	Web and mobile applications
Application needs a user directory managed by AWS	Cognito user pool	Cognito authentication returns a JWT	Application users
Authenticated application users need temporary permissions to AWS services	Cognito identity pool	JWT exchanged for temporary credentials	Web and mobile applications
Centralized access to multiple AWS accounts in an AWS Organization	IAM Identity Center	Users or groups assigned permission sets to accounts	Multi-account workforce environments

Exam-Relevant Takeaways

• Federation means using an external identity source to obtain access to AWS without creating and managing a separate long-term AWS credential for each user.
• AWS STS issues temporary security credentials after validating a trusted assertion or token.
• Use AssumeRoleWithSAML for SAML-based enterprise federation.
• Use AssumeRoleWithWebIdentity for web identity federation, including the flow behind Cognito identity pools.
• IAM Identity Center is the usual choice for centralized workforce single sign-on across AWS accounts and applications.
• Amazon Cognito is designed primarily for web and mobile application users.
• A Cognito user pool authenticates users and issues tokens; a Cognito identity pool exchanges those tokens for temporary AWS credentials.
• Authentication and authorization are separate: an identity provider authenticates the user, while IAM roles and policies authorize AWS actions.
• Temporary credentials should be preferred over embedding long-term IAM access keys in client-side or mobile applications.

Common Exam Traps

• Confusing IAM Identity Center with Cognito: IAM Identity Center is for workforce access and centralized AWS account or application access. Cognito is for users of web and mobile applications.
• Confusing Cognito user pools and identity pools: A user pool is an authentication directory and token issuer. An identity pool provides temporary AWS credentials.
• Selecting the wrong STS API: SAML assertions use AssumeRoleWithSAML; web identity tokens use AssumeRoleWithWebIdentity.
• Assuming federation grants permissions automatically: Federation establishes identity and obtains temporary credentials. IAM role trust policies and permissions policies still control access.
• Using long-term access keys in an application: A federated or Cognito-based temporary credential flow is safer and more appropriate for client applications.
• Treating an external directory as an AWS authorization system: Active Directory or another IdP authenticates users, but AWS IAM policies and roles determine access to AWS resources.
• Assuming a Cognito user pool alone grants AWS service access: An identity pool is required when the application needs temporary AWS credentials to call AWS services directly.

Real-World Engineer Notes

• Design the trust relationship before designing permissions. The IAM role assumed through federation needs a trust policy that permits the relevant federated principal.
• Keep application permissions narrow. A mobile application that only needs access to specific DynamoDB items should not receive broad account-level permissions.
• Use groups, attributes, or permission-set mappings to make access assignments manageable as the organization grows.
• Treat JWTs and SAML assertions as authentication artifacts, not as substitutes for IAM authorization controls.
• In multi-account environments, IAM Identity Center can centralize account assignments while keeping permissions defined through account-level permission sets and policies.
• When evaluating an exam scenario, identify both the user population and the required target: workforce single sign-on generally points to IAM Identity Center, while customer or application-user authentication generally points to Cognito.

Quick Reference Summary

• SAML: Enterprise federation protocol commonly used with Active Directory and other workforce identity providers.
• AssumeRoleWithSAML: AWS STS operation used to exchange a SAML assertion for temporary credentials.
• Web identity federation: Uses a web identity or OIDC-compatible token to obtain temporary AWS credentials.
• AssumeRoleWithWebIdentity: AWS STS operation used for web identity token exchange.
• IAM Identity Center: Centralized workforce SSO and account/application access management.
• Cognito user pool: Authenticates application users and issues JWTs.
• Cognito identity pool: Exchanges authenticated identities for temporary AWS credentials.
• Temporary credentials: Short-lived access keys, secret keys, and session tokens controlled by IAM role permissions.

Flashcards

1. Q: What is identity federation?

A: Connecting an external identity source to AWS so users can obtain AWS access without maintaining separate long-term AWS credentials.

1. Q: What does AWS STS provide in a federation workflow?

A: Temporary security credentials.

1. Q: Which STS operation is used with a SAML assertion?

A: AssumeRoleWithSAML.

1. Q: Which STS operation is used with a web identity token?

A: AssumeRoleWithWebIdentity.

1. Q: What is IAM Identity Center designed for?

A: Centralized workforce single sign-on and access management across AWS accounts and applications.

1. Q: What is the primary use of Amazon Cognito?

A: Authentication and authorization support for web and mobile application users.

1. Q: What does a Cognito user pool do?

A: Authenticates users and issues tokens such as JWTs.

1. Q: What does a Cognito identity pool do?

A: Exchanges authenticated user tokens for temporary AWS credentials.

1. Q: What determines what a federated user can do in AWS?

A: The IAM role and its attached permissions policies, subject to the role’s trust relationship.

1. Q: Which solution is generally appropriate for employees accessing multiple AWS accounts?

A: IAM Identity Center.

1. Q: Which solution is generally appropriate for customers signing in to a mobile application?

A: Amazon Cognito.

1. Q: Why should applications avoid embedding long-term IAM access keys?

A: Long-term credentials are difficult to protect and rotate; temporary federated credentials reduce exposure and limit the credential lifetime.

Practice Questions

Question 1

A company wants employees to use their existing corporate identity provider to sign in to several AWS accounts. Administrators need a centralized way to assign groups access to accounts and applications. Which solution best fits this requirement?

A. Amazon Cognito user pools
B. IAM Identity Center integrated with the corporate identity provider
C. An IAM user for every employee in every account
D. A Cognito identity pool with anonymous access

Correct answer: B

Explanation: IAM Identity Center is designed for centralized workforce SSO and can use an external SAML provider or directory. It integrates with AWS Organizations and supports account assignments through permission sets.

Question 2

A mobile application authenticates customers through Google. After authentication, the application must read only the required records from DynamoDB without storing AWS access keys in the application. Which design is most appropriate?

A. Store an IAM access key in the mobile application
B. Use IAM Identity Center for each customer
C. Use a Cognito user pool and identity pool with an IAM role containing least-privilege permissions
D. Create one IAM user shared by all mobile customers

Correct answer: C

Explanation: A Cognito user pool can authenticate users through Google, and a Cognito identity pool can exchange the resulting token for temporary AWS credentials. The IAM role should restrict access to only the required DynamoDB operations and resources.

Question 3

An enterprise uses Active Directory Federation Services and wants users to access an AWS role after authenticating against the corporate directory. Which AWS STS operation is part of the federation flow?

A. AssumeRole
B. AssumeRoleWithSAML
C. AssumeRoleWithWebIdentity
D. GetFederationTokenWithOIDC

Correct answer: B

Explanation: Active Directory Federation Services can issue a SAML assertion. AWS STS uses AssumeRoleWithSAML to exchange that assertion for temporary credentials.

Question 4

A developer has configured a Cognito user pool for application sign-in. The application must now call DynamoDB directly using temporary AWS credentials. What additional Cognito component is required?

A. An IAM Identity Center permission set
B. A Cognito identity pool
C. An additional user pool for administrators
D. A SAML assertion from Active Directory

Correct answer: B

Explanation: The user pool authenticates the user and issues a JWT. The identity pool uses the authenticated identity to obtain temporary AWS credentials that the application can use to call AWS services.

Question 5

A security architect states that a valid SAML assertion should allow a federated user to access any DynamoDB table in the account. Which response is correct?

A. The assertion automatically grants administrator permissions
B. The assertion authenticates the user, but the assumed IAM role policies determine the permitted DynamoDB actions
C. SAML can authenticate users but cannot be used with AWS STS
D. DynamoDB ignores credentials obtained through federation

Correct answer: B

Explanation: Federation establishes the user’s authenticated identity and enables AWS STS to issue temporary credentials. The IAM role’s trust and permissions policies determine which AWS actions and resources are available.