14. Advanced Identity

What does AWS STS (Security Token Service) enable?

Creating temporary, limited-privileges credentials to access your AWS resources

How long do STS credentials last?

They are short-term credentials — you configure the expiration period

What are the use cases for STS?

Identity federation (manage user identities in external systems and provide them with STS tokens to access AWS resources), IAM Roles for cross/same account access, and IAM Roles for Amazon EC2 (temporary credentials for EC2 instances to access AWS resources)

What is Amazon Cognito for?

Identity for your web and mobile application users (potentially millions)

How does Cognito differ from IAM for app users?

Instead of creating them an IAM user, you create a user in Cognito

What is Microsoft Active Directory (AD)?

Found on any Windows Server with AD Domain Services — a database of objects: user accounts, computers, printers, file shares, security groups

What does Active Directory provide?

Centralised security management — create accounts, assign permissions

What is AWS Managed Microsoft AD?

Create your own AD in AWS, manage users locally, supports MFA — can establish "trust" connections with your on-premise AD

What is AD Connector?

A directory gateway (proxy) to redirect to the on-premise AD, supports MFA — users are managed on the on-premise AD

What is Simple AD?

An AD-compatible managed directory on AWS — cannot be joined with on-premise AD

What does AWS IAM Identity Center provide?

One login (single sign-on) for all your AWS accounts in AWS Organisations, business cloud applications (e.g. Salesforce, Box, Microsoft), SAML 2.0-enabled applications, and EC2 Windows instances

What identity providers does IAM Identity Center support?

The built-in identity store in IAM Identity Center, or 3rd party: Active Directory (AD), OneLogin, Okta

Summarise IAM

Identity and access management inside your AWS account — for users that you trust and belong to your company

Summarise Organisations

Manage multiple accounts

Summarise Security Token Service (STS)

Temporary, limited-privileges credentials to access AWS resources

Summarise Cognito

Create a database of users for your mobile & web applications

Summarise Directory Services

Integrate Microsoft Active Directory in AWS

Summarise IAM Identity Center

One login for multiple AWS accounts & applications