Roles, federation and identity services
Most real access on AWS uses temporary credentials: applications assume roles, people sign in through a central identity provider, and app users sign in through Cognito. This chapter covers how those pieces fit together.
AWS STS and assuming roles
The AWS Security Token Service (STS) issues temporary credentials (an access key, secret key and session token that expire — typically after an hour, configurable).
A role has two policies:
- Trust policy — who may assume the role (an AWS service, another account, a federated identity provider).
- Permissions policy — what the role can do once assumed.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": { "AWS": "arn:aws:iam::111122223333:root" },
"Action": "sts:AssumeRole",
"Condition": { "StringEquals": { "sts:ExternalId": "partner-7731" } }
}]
}
Common role uses
| Scenario | How |
|---|---|
| EC2 app needs AWS access | Instance profile with an IAM role |
| Lambda, ECS tasks, other services | Execution / task roles |
| Engineers switching into another account | Role switching (cross-account role) |
| A third-party vendor accesses your account | Cross-account role with an external ID (prevents the "confused deputy" problem) |
| Users from a corporate directory | Federation into roles |
Cross-account access: role vs resource policy
| Approach | How it works | When |
|---|---|---|
| Cross-account role | User in account A assumes a role in account B; acts as account B | Broad access to many resources in B |
| Resource-based policy | Bucket/queue/key policy in B allows a principal from A directly | Access to a specific resource; caller keeps their own identity |
Federation
Federation lets users sign in with an existing identity — corporate directory, SAML identity provider or social login — instead of IAM users.
- SAML 2.0 — enterprise identity providers (e.g. Active Directory Federation Services, Okta, Microsoft Entra ID).
- OpenID Connect (OIDC) — modern identity providers; also used by CI/CD systems (e.g. GitHub Actions) to assume roles without stored keys.
AWS IAM Identity Center (successor to AWS SSO)
The recommended way to give people access to multiple AWS accounts:
- Connect your identity source (its own directory, Active Directory, or an external IdP via SAML/SCIM).
- Define permission sets (role templates) and assign them to users/groups per account.
- Users get a single portal and temporary credentials for console and CLI.
For workforce access to many accounts in an AWS Organization, the answer is almost always IAM Identity Center, not IAM users in each account.
AWS Directory Service
| Option | What it is | Use when |
|---|---|---|
| AWS Managed Microsoft AD | A real Microsoft Active Directory run by AWS | You need AD features in AWS (domain-joined Windows instances, FSx for Windows, trusts with on-premises AD) |
| AD Connector | A proxy that forwards authentication to your on-premises AD; stores nothing in AWS | Use existing on-prem AD with AWS services without syncing users |
| Simple AD | A small, AD-compatible directory (Samba-based) | Basic, low-cost directory needs; limited features |
Exam cue: "use existing on-premises Active Directory credentials, without replicating the directory to AWS" → AD Connector.
Amazon Cognito — identity for your app's users
| Part | Does what |
|---|---|
| User pools | A user directory for authentication: sign-up, sign-in, MFA, social and SAML login, hosted UI; issues JSON Web Tokens (JWTs) |
| Identity pools (federated identities) | Exchange a token (from a user pool, social provider or SAML) for temporary AWS credentials to call AWS services directly |
Typical patterns:
- Web/mobile app login → user pool; API Gateway or ALB validates the JWT.
- Mobile app uploads photos straight to S3 → user pool for login + identity pool for scoped AWS credentials (e.g. only to
uploads/${userId}/).
Cognito is for customers of your application. IAM Identity Center is for your workforce accessing AWS accounts. Don't mix them up.
Exam patterns
- "Allow a mobile app to upload directly to S3 without embedding keys" → Cognito identity pool (or pre-signed URLs from a backend).
- "A partner company needs limited access to your account" → cross-account role with external ID.
- "Single sign-on for employees across 50 accounts" → IAM Identity Center.
- "Windows instances must join the on-premises domain" → Managed Microsoft AD with a trust, or AD Connector.
Senior Full-Stack Engineer · AI & AWS. I design and run production systems on AWS — serverless, data and AI.