AWS Identity Sources
Several services on AWS accept identities, and each accepts a different set of sources.
1. Native AWS identities
Section titled “1. Native AWS identities”- IAM users
- IAM roles
- IAM user groups
- AWS Organizations, for the account structure those identities operate within
2. IAM Identity Center
Section titled “2. IAM Identity Center”IAM Identity Center supports exactly one identity source at a time, chosen from three:
- Identity Center directory — the built-in directory, for organisations with no external provider
- Active Directory — either AWS Managed Microsoft AD or an existing on-premises directory reached through AD Connector
- External identity provider — any SAML 2.0 provider, including Microsoft Entra ID, Okta, Google Workspace, Ping and OneLogin
With an external provider, users and groups are kept in step by SCIM provisioning where the provider supports it. Providers with no compatible SCIM implementation — AD FS among them — require users and groups to be provisioned manually. See SCIM.
3. Amazon Cognito
Section titled “3. Amazon Cognito”A Cognito user pool authenticates its own local users and federates with:
- Social identity providers: Google, Facebook, Login with Amazon, Sign in with Apple
- SAML 2.0 identity providers
- OpenID Connect (OIDC) providers
There is no direct LDAP integration. An LDAP directory reaches Cognito by being fronted by a SAML or OIDC provider that speaks to it.
4. AWS Directory Service
Section titled “4. AWS Directory Service”- AWS Managed Microsoft AD — a managed Active Directory in AWS, in Standard or Enterprise Edition, with a Hybrid Edition for extending an existing directory
- AD Connector — a proxy to an existing on-premises Active Directory
- Simple AD — a small standalone directory built on Samba
5. External identity providers, used directly with IAM
Section titled “5. External identity providers, used directly with IAM”Where IAM Identity Center is not in play, IAM itself can trust an external provider:
- A SAML 2.0 provider registered in the account, backing
sts:AssumeRoleWithSAML - An OIDC provider registered in the account, backing
sts:AssumeRoleWithWebIdentity— this is how GitHub Actions and other CI systems obtain credentials without stored keys - A custom identity broker application that authenticates users itself and then calls AWS STS
Choosing
Section titled “Choosing”| Population | Source |
|---|---|
| Employees and contractors reaching AWS accounts | IAM Identity Center, with the corporate directory as its identity source |
| Customers of an application | Amazon Cognito user pool, federating to social or enterprise providers as needed |
| Windows workloads that must join a domain | AWS Managed Microsoft AD, or AD Connector to an existing domain |
| CI pipelines and external automation | An OIDC provider registered in IAM, assuming a role — never an access key |
| AWS services acting on your behalf | IAM roles, through service principals and service-linked roles |