Determining when to federate a directory service with IAM roles

Task Statement 1.2: Design secure workloads and applications.

📘AWS Certified Solutions Architect – (SAA-C03)

---

1. What is Federation in AWS?

Federation is a way to allow users from an external identity system (like a company’s Active Directory or a third-party identity provider) to access AWS resources without creating individual IAM users in AWS.

• Instead of creating separate IAM accounts for every user in your company, federation lets your existing users log in using their current credentials.
• AWS uses IAM roles for this access. Users temporarily assume these roles when they log in.

Key idea: Federation = Use existing identity system → Assume temporary IAM roles → Access AWS resources.

---

2. Why Federation is Useful

1. Centralized Identity Management:
   • Users are managed in one place (like your corporate directory). No need to maintain separate IAM users in AWS.
2. Temporary Access:
   • Federated users do not have permanent AWS credentials. They assume a role and get temporary permissions. This is more secure.
3. Single Sign-On (SSO):
   • Users can use one set of credentials to access multiple systems, including AWS.
4. Compliance & Security:
   • Because you’re not creating long-term IAM users, it’s easier to audit and rotate access.

---

3. How Federation Works (Step by Step)

1. External Identity Provider:
   • This could be:
     • AWS Managed Microsoft AD
     • Active Directory (on-premises)
     • SAML 2.0 provider (like Okta or Azure AD)
2. User Requests Access:
   • A user logs in to the company identity system (e.g., Active Directory).
3. Identity Provider Issues Token:
   • The identity provider verifies the user and sends a SAML assertion or token to AWS.
4. AWS Maps User to IAM Role:
   • AWS checks which IAM role the user can assume based on the SAML token.
5. Temporary Credentials Granted:
   • The user assumes the IAM role and receives temporary security credentials (AWS Access Key, Secret Key, and Session Token).
6. User Accesses AWS Resources:
   • Now, the user can perform actions in AWS as defined by the IAM role.

---

4. When to Use Federation with IAM Roles

You should consider federation in AWS when:

1. You have existing corporate users:
   • If your company already has an identity directory like Active Directory, LDAP, or a cloud identity provider.
2. You want centralized control of users:
   • All user accounts and access policies are managed outside AWS.
3. You need temporary or role-based access:
   • For contractors, developers, or admins who need time-limited access to specific resources.
4. You want to enforce SSO:
   • Users should log in once and access multiple AWS accounts without multiple credentials.
5. You want to reduce risk from permanent IAM users:
   • Federated access removes the need for permanent long-term IAM credentials.

---

5. Key AWS Services and Features Involved

1. IAM Roles
   • Define permissions.
   • Can be assumed by federated users.
2. Identity Providers (IdP)
   • External system that authenticates users.
   • Examples: Active Directory, Okta, Azure AD, Google Workspace.
3. SAML 2.0
   • Security Assertion Markup Language, a standard for exchanging authentication and authorization data between an IdP and AWS.
4. AWS STS (Security Token Service)
   • Provides temporary credentials when a user assumes a role.

---

6. Example Scenarios in an IT Environment

• Scenario 1: Your company has 500 employees. You don’t want to create 500 IAM users in AWS. Instead, employees log in with their corporate directory credentials. AWS roles define what each employee can do.
• Scenario 2: A contractor needs access to AWS S3 buckets for 1 month. Instead of creating an IAM user, you give them a federated login with a role that expires in 1 month.
• Scenario 3: You manage multiple AWS accounts. You can federate users from a single directory and let them assume roles in any account without creating IAM users in each account.

---

7. Key Exam Tips

1. Remember Federation = No IAM Users
   • Federated users do not have IAM user accounts. They assume roles temporarily.
2. Use When You Have an Existing Directory
   • Common for enterprises using Active Directory or SAML-based IdPs.
3. Temporary Credentials
   • AWS STS is always involved. Credentials are time-limited.
4. Role Mapping
   • Each federated user or group is mapped to an IAM role with defined permissions.
5. SAML vs. OIDC
   • SAML is for enterprise identity providers. OIDC (OpenID Connect) is often used for web/mobile apps.

---

✅ Summary Table: Federation with IAM Roles

Feature	Description
Federation	Access AWS with existing corporate credentials
IAM Role	Temporary permissions assumed by federated users
Identity Provider (IdP)	External system that verifies users (AD, Okta, Azure AD)
Temporary Credentials	Provided by AWS STS, expire automatically
Use Case	Centralized user management, temporary access, SSO, reduce permanent IAM users
Exam Tip	Think: “Do I need IAM users? If not, use federation”

---

Bottom Line for the Exam

• If users already exist outside AWS, and you want temporary, role-based access, federation is the correct choice.
• Always focus on IAM roles, temporary credentials, and external identity providers.
• Federation helps simplify management, enhance security, and support SSO.