Advanced Identity

STS, Cognito, Directory Services, IAM Identity Center & RAM

AWS STS (Security Token Service)

Enables you to create temporary, limited-privilege credentials to access AWS resources.
Credentials are short-lived — configurable expiration period (minutes to hours).
Global service with a single endpoint: sts.amazonaws.com (can also use regional endpoints).

Key API Calls

API Call	Description
`AssumeRole`	Assume a role within your account or cross-account. Returns temporary credentials.
`AssumeRoleWithSAML`	Return credentials for users logged in with SAML (corporate identity federation).
`AssumeRoleWithWebIdentity`	Return credentials for users logged in with a web identity provider (Google, Facebook, OIDC). AWS recommends using Cognito instead.
`GetSessionToken`	Get temporary credentials for an IAM user or root user (for MFA).
`GetCallerIdentity`	Return details about the IAM user or role whose credentials are used to call the API.
`DecodeAuthorizationMessage`	Decode error messages when an API call is denied.

How AssumeRole Works

An IAM user/role/service calls STS:AssumeRole.
STS validates the request and returns temporary security credentials (access key, secret key, session token).
These credentials can be used to make API calls with the permissions of the assumed role.
Use cases: cross-account access, granting temporary elevated permissions, identity federation.

Exam Tip:

STS provides temporary credentials. Think of it whenever the question mentions temporary access, cross-account access, or assuming a role.

Amazon Cognito

Provides identity for web and mobile application users (potentially millions of users). Instead of creating IAM users for every app user, use Cognito.

Cognito User Pools (CUP)

Authentication (identity verification) — sign-up and sign-in functionality for app users.
Creates a serverless database of users for your application.
Features: username/password login, email/phone verification, MFA, password policies.
Social identity federation — Login with Google, Facebook, Apple, Amazon, SAML, OIDC.
Returns a JSON Web Token (JWT) upon successful authentication.
Integrates with API Gateway and ALB for authentication.
Supports hosted UI for sign-in/sign-up pages.

Cognito Identity Pools (Federated Identities)

Authorization (access control) — provide temporary AWS credentials to users so they can access AWS resources directly.
Users can be: Cognito User Pool users, social login users (Google, Facebook, Apple), SAML/OIDC users, or guest (unauthenticated) users.
Users are mapped to IAM roles. Credentials are obtained from STS.
Can define default IAM roles for authenticated and guest users.
Fine-grained access control with policy variables (e.g., user can only access their own S3 folder).

User Pools vs Identity Pools

Feature	User Pools	Identity Pools
Purpose	Authentication (who you are)	Authorization (what you can access)
Returns	JWT token	Temporary AWS credentials (via STS)
Use Case	Sign-up/sign-in for your app	Access AWS services (S3, DynamoDB, etc.)
Social Login	Yes	Yes (through User Pool or directly)
Guest Access	No	Yes

Key Point:

Cognito User Pools = sign-up/sign-in (authentication). Cognito Identity Pools = temporary AWS credentials (authorization). They can work together: User Pool authenticates, then Identity Pool grants AWS access.

AWS Directory Services

AWS provides three directory service options to integrate with Microsoft Active Directory (AD).

What is Microsoft Active Directory?

Database of user accounts, computers, printers, file shares, security groups.
Centralized security management — user login, permissions, policies.
Objects are organized in trees. Groups of trees form a forest.
Uses LDAP and Kerberos protocols.

Three Directory Service Options

Service	Description	Use Case
AWS Managed Microsoft AD	Create your own AD in AWS. Fully managed, runs on Windows Server. Supports MFA. Establish trust connection with on-premises AD (users exist in both).	You need a full-featured Active Directory in AWS, possibly with trust to on-premises AD.
AD Connector	A proxy (gateway) to redirect directory requests to your existing on-premises AD. Users are managed only on-premises. Supports MFA.	You want to use your existing on-premises AD with AWS services. No caching, purely a proxy.
Simple AD	AD-compatible managed directory powered by Samba 4. Basic AD features. Cannot be joined with on-premises AD (no trust).	You need a basic, low-cost AD in the cloud with no on-premises integration.

Exam Tip:

Managed Microsoft AD = full AD in AWS, can trust on-premises. AD Connector = proxy to on-premises AD (no AD in AWS). Simple AD = standalone basic AD in AWS (no on-premises connection).

AWS IAM Identity Center (Successor to AWS SSO)

Provides single sign-on (SSO) to access multiple AWS accounts and business applications from one login.
One login (single sign-on) for all your AWS accounts in AWS Organizations.
Supports integration with business apps: Salesforce, Box, Microsoft 365, Slack, custom SAML 2.0 apps.
Also provides SSO for EC2 Windows instances.

Identity Providers

Built-in identity store — Create and manage users directly in IAM Identity Center.
3rd-party identity providers — Active Directory (AWS Managed AD, AD Connector, self-managed AD), external IdPs (Okta, OneLogin, Azure AD) via SAML 2.0.

How It Works

User logs in to the IAM Identity Center portal once.
Portal shows all AWS accounts and applications the user has access to.
User clicks to access any account/app without logging in again.
Uses Permission Sets to define what users can do in each AWS account (maps to IAM roles).

Fine-Grained Permissions

Multi-Account Permissions — Manage access across AWS accounts in your organization.
Permission Sets — Collection of IAM policies assigned to users/groups for specific AWS accounts.
Application Assignments — SSO access to SAML 2.0 business applications.
ABAC (Attribute-Based Access Control) — Fine-grained permissions based on user attributes (department, title, locale).

Key Point:

IAM Identity Center = one login for all AWS accounts and business apps. It's the recommended way to manage human user access to multiple AWS accounts. Successor to AWS SSO.

AWS Resource Access Manager (RAM)

Share AWS resources that you own with other AWS accounts.
Can share with any account or within your AWS Organization.
Avoids resource duplication — share instead of recreating in each account.

Resources You Can Share

Resource	Details
VPC Subnets	Allow other accounts to launch resources in your VPC subnets. All resources must be in the same AWS Organization. Cannot share security groups or the default VPC.
AWS Transit Gateway	Share a Transit Gateway across accounts for centralized network connectivity.
Route 53 Resolver Rules	Share DNS resolver rules across accounts.
License Manager Configurations	Share software license configurations.
Aurora DB Clusters	Share Aurora clusters across accounts.
ACM Private Certificate Authority	Share private CA across accounts.
CodeBuild Projects	Share build projects across accounts.
EC2 (Dedicated Hosts, Capacity Reservations)	Share dedicated resources across accounts.

VPC Subnet Sharing Details

Each account is responsible for its own resources (EC2, Lambda, etc.).
Each account cannot view, modify, or delete resources belonging to other accounts.
Network is shared: resources in the shared subnet can communicate via private IPs.
Security groups from other accounts can be referenced for maximum security.

Exam Tip:

RAM = share resources across accounts without duplication. Most commonly asked about VPC subnet sharing and Transit Gateway sharing. This is different from IAM Identity Center (which shares access, not resources).

Quick Comparison: Identity Services

Service	Purpose	Users
IAM	Manage AWS account access	Internal users (developers, admins)
STS	Temporary credentials	Users/services needing short-lived access
Cognito	App user identity	External users (web/mobile app users, millions)
Directory Services	Microsoft AD integration	Corporate users with existing AD
IAM Identity Center	SSO for multiple accounts/apps	Organization users needing central login
RAM	Share resources across accounts	Other AWS accounts in your org

Key Point:

IAM = internal AWS users. Cognito = external app users. IAM Identity Center = SSO across accounts. STS = temporary credentials. RAM = resource sharing.