Advanced Identity

1. AWS STS (Security Token Service)

AWS STS enables you to create temporary, limited-privilege credentials to access your AWS resources.

• They are short-term credentials — you configure the expiration period.

Use cases from the slides:

• Identity federation — manage user identities in external systems, and provide them with STS tokens to access AWS resources.
• IAM Roles for cross-account or same-account access.
• IAM Roles for Amazon EC2 — provide temporary credentials for EC2 instances to access AWS resources.

The flow is always the same: a user (or a service) assumes a role, the STS service hands back temporary security credentials, and those credentials are used to access AWS resources.

Exam tip

Any question whose wording contains “temporary credentials”, “assume role” or “expire after N minutes” is pointing at STS.

2. Amazon Cognito

Amazon Cognito provides identity for your Web and Mobile application users — potentially millions of them.

The key idea: instead of creating them an IAM user, you create a user in Cognito. Cognito holds a database of users that your web and mobile applications log in against, and it can also broker logins from a Social Identity Provider — Facebook, Google, Twitter and the like.

Exam tip

IAM users are for people inside your company that you trust. Cognito users are for the customers of your application. Creating an IAM user per app end-user is always the wrong answer.

3. Microsoft Active Directory and AWS Directory Services

What is Microsoft Active Directory (AD)?

• Found on any Windows Server with AD Domain Services.
• A database of objects: User Accounts, Computers, Printers, File Shares, Security Groups.
• Provides centralized security management — create an account, assign permissions.

Authentication runs against a Domain Controller, which validates a user such as John and his password.

AWS Directory Services

Three flavours, and the exam expects you to tell them apart:

Service	What it does
AWS Managed Microsoft AD	Create your own AD in AWS, manage users locally, supports MFA; can establish a “trust” connection with your on-premises AD
AD Connector	A Directory Gateway (proxy) that redirects to the on-premises AD, supports MFA; users are managed on the on-premises AD
Simple AD	An AD-compatible managed directory on AWS; cannot be joined with an on-premises AD

Real-world example

A company that wants to keep its user database in its own data centre but still let AWS workloads authenticate against it deploys an AD Connector — no users are copied into AWS, every authentication is proxied back on-premises. If instead it wants its own directory in AWS that still trusts the corporate one, it deploys AWS Managed Microsoft AD and sets up the trust.

4. AWS IAM Identity Center

AWS IAM Identity Center is the successor to AWS Single Sign-On. It gives you one login (single sign-on) for:

• All your AWS accounts in AWS Organizations.
• Business cloud applications — for example Salesforce, Box, Microsoft 365.
• SAML2.0-enabled applications.
• EC2 Windows Instances.

The identity providers it can use:

• The built-in identity store in IAM Identity Center.
• 3rd party providers: Active Directory (AD), OneLogin, Okta and others.

The login flow is a single sign-on into IAM Identity Center, which then fans out to every account and application the user is entitled to.

Exam tip

“One login for many AWS accounts and third-party business applications” is IAM Identity Center, not IAM and not Cognito.

5. Advanced Identity — summary

• IAM — Identity and Access Management inside your AWS account, for users that you trust and that belong to your company.
• Organizations — manage multiple accounts (see Account Management, Billing & Support).
• Security Token Service (STS) — temporary, limited-privilege credentials to access AWS resources.
• Cognito — create a database of users for your mobile and web applications.
• Directory Services — integrate Microsoft Active Directory in AWS.
• IAM Identity Center — one login for multiple AWS accounts and applications.

Quick recap

Concept	What to remember for the exam
AWS STS	Temporary, limited-privilege credentials with a configurable expiry; federation, cross-account roles, EC2 roles
Amazon Cognito	User database for web/mobile app users, plus social identity providers — not IAM users
Microsoft AD	Windows Server with AD Domain Services; objects + centralized security; domain controller authenticates
AWS Managed Microsoft AD	Your own AD in AWS, users managed locally, MFA, trust with on-premises AD
AD Connector	Proxy/gateway to the on-premises AD; users stay on-premises; MFA supported
Simple AD	AD-compatible managed directory in AWS; cannot join an on-premises AD
IAM Identity Center	Successor to AWS SSO; one login for Organizations accounts, SAML2.0 and business apps, EC2 Windows; built-in store or AD/Okta/OneLogin