Skip to content
PuglieseWeb Engineering HandbookSystemDox Pages

Identity Management Services

Three services cover identity on AWS, and they are not alternatives. Each serves a different population, and all three ultimately resolve to an IAM role.

flowchart TB subgraph Sources["Where identities come from"] Ext["External identity providers<br/>Entra ID, Okta, Google, Apple, SAML, OIDC"] Local["Local directories<br/>Identity Center directory, Cognito user pool"] end subgraph Services["Identity services"] IC["AWS IAM Identity Center<br/>workforce"] Cognito["Amazon Cognito<br/>application end users"] end subgraph Core["Authorization core"] Roles["IAM roles"] Policies["IAM policies"] STS["AWS STS"] end Ext --> IC Ext --> Cognito Local --> IC Local --> Cognito IC -->|Permission sets| Roles Cognito -->|Identity pool| Roles Roles --> Policies Roles --> STS STS -->|Temporary credentials| AWSsvc["AWS services"]

AWS IAM

Section titled “AWS IAM”

The foundational service. IAM defines the principals, roles and policies that every authorization decision is made against.

  • Creates and manages users, roles and policies within an account
  • The right choice for service-to-service authentication, and for AWS administrative access where federation is not yet in place
  • Every other identity service on this page ends by handing the caller an IAM role

See IAM.

Amazon Cognito

Section titled “Amazon Cognito”

Customer and end-user identity, for web and mobile applications.

  • User pools handle registration, sign-in, password policy, MFA and profile management, and issue JWTs
  • Identity pools exchange those tokens — or tokens from a social or enterprise provider — for temporary AWS credentials, so a client can call an AWS service directly
  • Federates with social providers, SAML 2.0 providers and OIDC providers
  • Scales to large user populations without an operational burden

See Amazon Cognito.

AWS IAM Identity Center

Section titled “AWS IAM Identity Center”

Workforce identity, across many accounts. Formerly AWS Single Sign-On.

  • Centralises access management for every account in an AWS Organizations organisation
  • Provides one access portal for AWS accounts and for business applications
  • Uses an external identity provider — Active Directory, Entra ID, Okta or any SAML 2.0 provider — or its own directory
  • Permission sets map groups to roles in member accounts, so one person can hold different access in different accounts
  • Issues short-lived credentials per session; no access keys to manage

See Controlling access in AWS Organizations.

Choosing

Section titled “Choosing”
QuestionService
Who are the identities?Employees and contractors → IAM Identity Center. Application customers → Cognito. Workloads and services → IAM roles
Where do they live today?A corporate directory → federate it. Nowhere → a Cognito user pool or the Identity Center directory
What do they need to reach?AWS accounts and the console → Identity Center. An application, and possibly an AWS API from the client → Cognito

The two are frequently used together in the same estate: Cognito for customers reaching the product, IAM Identity Center for employees reaching the accounts that run it. Underneath both, IAM roles and policies are what actually authorise anything, and AWS STS is what issues the credentials.