Identity

IAM is the authorisation engine for AWS itself. The services in this section are the ones that put an identity in front of IAM and then hand the caller an IAM role.

Amazon Cognito is for the users of an application — customers signing up to a web or mobile product. A user pool is the directory and the OAuth 2.0 / OIDC provider; an identity pool exchanges a pool token for temporary AWS credentials when a client needs to call an AWS service directly.

AWS STS is the service that issues those temporary credentials. Every role assumption, every federated sign-in and every instance profile ultimately goes through it.

AWS Directory Service covers the Active Directory options: AWS Managed Microsoft AD for directory-aware Windows workloads, AD Connector as a proxy to an existing on-premises directory, and Simple AD for basic, low-scale needs.

OAuth 2.0 vs OpenID Connect explains the protocol distinction that underlies Cognito, IAM Identity Center and every external IdP integration.

Identity management services puts IAM, Cognito and IAM Identity Center side by side and shows how each resolves to IAM roles.

Workforce identity — how employees reach many AWS accounts — is covered under IAM, which holds the IAM Identity Center, SCIM and Active Directory federation material.