AWS › IAM
How does IAM support federated identity and single sign on integration with external identity providers like corporate Active Directory or a SAML based provider?
AdvancedAnswer
IAM supports identity federation, letting users authenticate using their existing corporate credentials through an external identity provider using standards like SAML or OpenID Connect, and upon successful authentication, IAM issues temporary security credentials mapped to a specific IAM role, meaning organizations can extend their existing centralized identity management system to control AWS access without needing to create and separately manage a completely distinct set of IAM users for every employee.
aws iam create-saml-provider --saml-metadata-document file://saml-metadata.xml --name CorporateADFSReal-world example A large enterprise integrates its existing Active Directory Federation Services with IAM, allowing employees to access the AWS console using their familiar corporate login credentials, with their AWS permissions automatically determined based on their existing Active Directory group memberships.