External identities and federation in AWS
In the realm of AWS IAM, the ability to integrate external identities and establish federation is a powerful feature that facilitates seamless and secure access to AWS resources. This integration allows organizations to leverage their existing identity solutions, such as corporate directories or social identity providers, to grant access to AWS without the need to create a separate IAM user for each individual. To better grasp this concept, let’s delve into the role and mechanics of external identities in AWS.
Understanding external identities
External identities refer to identities that are managed outside of AWS. These can be identities from a corporate directory such as Microsoft Active Directory (AD), IdPs such as Okta or Auth0, or other IdPs compatible with OpenID Connect (OIDC) or SAML 2.0. The primary advantage of using external identities is that organizations can maintain a centralized identity source, making user management, authentication, and authorization more streamlined and consistent.
Federation in AWS
Federation, in the context of AWS, is the process of delegating authentication and, potentially, authorization to an external system. Instead of directly authenticating against AWS, the user authenticates against the external identity provider. Once authenticated, the user is granted temporary access to AWS resources based on the permissions mapped to their external identity.
How federation works
Federation in AWS involves a series of steps that authenticate, validate, and grant access to users from an external IdP. Here are the steps that are followed in case of a SAML-based IdP:
- Authentication: First, the user authenticates with the IdP, typically through a corporate login portal or another SAML-based authentication system.
- SAML assertion issuance: Upon successful authentication, the IdP issues a SAML assertion. This assertion contains information about the user’s identity and attributes, along with a digital signature to ensure its authenticity.
- SAML assertion exchange: The user or application then sends the SAML assertion to AWS STS.
- Temporary credentials: STS validates the SAML assertion with the IdP and, if successful, issues temporary AWS credentials to the user. These credentials allow the user to access AWS resources based on the IAM permissions defined for their identity.