Mastering Identity Federation: AWS IAM Identity Center & Identity Providers

Identity federation is a critical component of the AWS Certified DevOps Engineer - Professional curriculum. It enables centralized management of users across multiple accounts and applications without the need to recreate individual IAM users in every environment. This guide explores the mechanisms, tools, and best practices for implementing federation at scale.

Learning Objectives

After studying this guide, you should be able to:

• Differentiate between IAM Identity Providers and AWS IAM Identity Center.
• Describe the workflow for SAML 2.0 and OpenID Connect (OIDC) federation.
• Explain how to integrate Active Directory (AD) with AWS.
• Configure Permission Sets and multi-account access strategies.
• Understand Just-In-Time (JIT) provisioning and its benefits.

Key Terms & Glossary

• IdP (Identity Provider): A service that manages identity information (e.g., Okta, PingFederate, Azure AD).
• SP (Service Provider): The entity providing the resource, in this case, AWS.
• SAML 2.0: An XML-based open standard for exchanging authentication and authorization data between parties.
• OIDC (OpenID Connect): An identity layer on top of the OAuth 2.0 protocol.
• Trust Policy: A JSON policy document attached to an IAM role that defines which principals can assume the role.
• Permission Set: A template in IAM Identity Center that defines the level of access users and groups have to specific AWS accounts.

The "Big Idea"

Instead of managing a separate database of users for every application or AWS account (Identity Silos), federation allows you to use a single "Source of Truth" (your corporate directory). This simplifies the onboarding/offboarding process: when an employee leaves the company and is deactivated in the corporate AD, their access to all AWS resources is revoked automatically.

Formula / Concept Box

Hierarchical Outline

• I. AWS IAM Identity Center (Successor to AWS SSO)
  • Centralized Management: Manage access to multiple AWS accounts and business apps (Salesforce, Microsoft 365).
  • External Directory Sync: Connects to Microsoft AD (via AD Connector or Managed Microsoft AD) or SAML IdPs.
  • User Experience: Provides a web-based user portal for one-click access to assigned accounts.
• II. IAM Identity Providers (Standard Federation)
  • SAML 2.0: Used for web-based SSO for human users.
  • OIDC: Commonly used for machine-to-machine or mobile app federation (e.g., Login with Google/Amazon).
  • STS (Security Token Service): The engine that generates temporary, limited-privilege credentials for federated users.
• III. Permission Management
  • Role-Based Access Control (RBAC): Assigning users to groups in the IdP that map to IAM roles in AWS.
  • Attribute-Based Access Control (ABAC): Using tags (attributes) from the IdP to make granular access decisions.

Visual Anchors

SAML Federation Workflow

IAM Identity Center Architecture

Definition-Example Pairs

• Just-In-Time (JIT) Provisioning: The automatic creation of a user profile in a service provider the first time they authenticate via an IdP.
  • Example: A new DevOps engineer joins the company. Upon their first login to the AWS Console via Okta, IAM Identity Center automatically creates their local identity record based on their Okta attributes.
• SCIM (System for Cross-domain Identity Management): An HTTP-based protocol used to automate the exchange of user identity information between identity domains.
  • Example: When a user is added to the "Admins" group in Azure AD, SCIM immediately pushes that change to AWS IAM Identity Center, granting the user administrative access without manual intervention.

Worked Example: Connecting Active Directory to IAM Identity Center

Scenario: A company uses self-managed Microsoft Active Directory on-premises and wants their developers to access AWS accounts using their existing AD credentials.

1. Establish Connectivity: Set up an AWS Direct Connect or Site-to-Site VPN between the on-premises data center and the VPC.
2. AD Connector: Deploy an AWS Directory Service AD Connector. This acts as a proxy that redirects directory requests to your on-premises AD without caching information in the cloud.
3. Enable IAM Identity Center: In the AWS Management Console, navigate to IAM Identity Center and choose Change Identity Source.
4. Select Directory: Choose "Active Directory" and select the AD Connector created in step 2.
5. Assign Access: Select AD groups (e.g., "CloudEngineers") and associate them with specific AWS accounts and Permission Sets (e.g., AdministratorAccess).
6. Verification: Users log in via the https://d-xxxxxxxx.awsapps.com/start URL using their standard Windows credentials.

Checkpoint Questions

1. What is the main advantage of using IAM Identity Center over manually creating IAM Identity Providers in 50 different AWS accounts?
2. Which AWS service is responsible for issuing temporary security credentials during a federation request?
3. True or False: IAM Identity Center requires you to manage passwords for your users within the AWS Console.
4. What protocol is used to automatically synchronize user additions and deletions from an external IdP to AWS?

[!TIP] Answer Key: 1. Centralized management (change once, apply everywhere); 2. AWS Security Token Service (STS); 3. False (Passwords are managed at the IdP); 4. SCIM.

Muddy Points & Cross-Refs

• IAM Role vs. IAM User: In federation, users never log in as IAM Users. They log in to the IdP and assume an IAM Role.
• Trust Policy vs. Permissions Policy: A Trust Policy determines who can use the role (the IdP), while the Permissions Policy determines what they can do once they have the role.
• Cross-Account Access: While federation provides access, you might still use Cross-Account Roles for automation/scripts that need to hop between accounts using sts:AssumeRole directly.

Comparison Tables

[!IMPORTANT] For the DevOps Professional exam, remember that IAM Identity Center is the recommended best practice for human access in a multi-account environment managed by AWS Organizations.