2.1.1.4. Federated Access and IAM Identity Center
2.1.1.4. Federated Access and IAM Identity Center
💡 First Principle: Federated access enables secure AWS login using existing corporate identities, centralizing identity management, simplifying access, and enhancing security posture.
Federated access allows users to access AWS using credentials from an external identity system (e.g., your corporate directory) instead of creating separate IAM users in AWS. This streamlines user management and enhances security by using a single source of truth for identity.
AWS IAM Identity Center (SSO) is a service that makes it easy to centrally manage access to multiple AWS accounts and business applications. It allows users to sign in with their existing corporate credentials and access their assigned AWS accounts and applications from a single portal.
Key Benefits of Federated Access & Identity Center:
- Centralized Identity Management: Manage users in one place (e.g., Active Directory).
- Simplified User Experience: Single sign-on to multiple AWS accounts and applications.
- Enhanced Security: No need to manage duplicate credentials, leverages existing enterprise security policies.
- Temporary Credentials: Users assume IAM roles in AWS, receiving temporary credentials.
Federation building blocks:
- IAM identity provider: For direct federation into an account (without Identity Center), create an IAM identity provider entity (SAML 2.0 or OIDC) that records the trust with the external IdP, then create IAM roles whose trust policy names that provider. Users arrive with an assertion and receive temporary credentials through
sts:AssumeRoleWithSAML(orAssumeRoleWithWebIdentityfor OIDC) — no IAM users are created.
AWS Directory Service options:
| Option | What it is | Trust with on-premises AD? |
|---|---|---|
| AWS Managed Microsoft AD | Actual Microsoft AD run by AWS; services such as RDS for SQL Server, FSx for Windows File Server and WorkSpaces can join it | Yes — one-way or two-way trusts with your on-premises domain |
| AD Connector | Proxy that redirects authentication requests to your existing on-premises AD; stores no directory data in AWS | No — it is a gateway, not a domain |
| Simple AD | Low-cost Samba-based, AD-compatible directory for basic needs (closed to new customers since July 30, 2026; AWS recommends AWS Managed Microsoft AD) | No |
Scenario: An enterprise needs to allow its employees to access multiple AWS accounts and applications using their existing on-premises Active Directory credentials, without creating individual IAM users in each AWS account.
Visual: Federated Access with IAM Identity Center
⚠️ Common Pitfall: Trying to manage separate IAM users in multiple accounts for a large organization. This becomes an administrative nightmare and increases the risk of inconsistent security practices.
Key Trade-Offs:
- Simplicity (IAM Users) vs. Integration/Scalability (Federation): Using IAM users is simpler for small-scale, non-enterprise setups. Federation provides centralized control and scalability for large organizations but requires more initial setup.
Reflection Question: How does federated access using AWS IAM Identity Center (SSO) fundamentally shift the burden of identity management and improve security for large organizations by streamlining access control?
