The company already has a user directory.
Users should sign in through that directory and receive temporary AWS access without adding long-term AWS passwords.
Which authentication approach fits the requirement?
Federation connects an external identity provider to AWS roles, allowing authenticated users to receive temporary AWS sessions.
Detailed explanation
Federation uses the external directory for authentication and AWS roles for scoped temporary authorization.
Federation uses the external directory for authentication and AWS roles for scoped temporary authorization.
Fixed long-term passwords increase exposure and do not provide centralized identity governance.
Fixed long-term passwords increase exposure and do not provide centralized identity governance.
An account has one root identity and it is not a workforce-user management method.
An account has one root identity and it is not a workforce-user management method.
Public access removes authentication and authorization rather than integrating the directory.
Public access removes authentication and authorization rather than integrating the directory.
Check official documentation
Compare the following points with the official documentation.
AWS IAM User GuideのFederated usersとIAM rolesの説明を確認する。
What to confirm
外部ディレクトリで認証した利用者に、AWSロールの範囲で一時セッションが発行される。
Key points
- Federation
- Identity provider
- Temporary session
Notes
- Environment: AWS公式IAM認証方式の確認
- Confirm current IAM capabilities and recommended practices in the official AWS documentation.
Foundation review
Authentication versus authorization
The external provider verifies identity; AWS roles and policies determine allowed actions.
Credential reduction
Federation avoids maintaining a separate long-term AWS password for every workforce user.