Advanced Identity

Question 1

AWS STS (SecurityToken Service)

Answer 1

• Enables you to create temporary, limited- privileges credentials to access your AWS resources
• Short-term credentials: you configure expiration period
• Use cases
  
  • Identity federation: manage user identities in external systems, and provide them with STS tokens to access AWS resources
  • IAM Roles for cross/same account access
  • IAM Roles for Amazon EC2: provide temporary credentials for EC2 instances to access AWS resources

Question 2

Amazon Cognito (simplified)

Answer 2

• Identity for your Web and Mobile applications users (potentially millions)
• Instead of creating them an IAM user, you create a user in Cognito

Question 3

AWS Directory Services

Answer 3

• AWS Managed Microsoft AD
  
  • Create your own AD in AWS, manage users locally, supports MFA
  • Establish “trust” connections with your on- premise AD
• AD Connector
  
  • Directory Gateway (proxy) to redirect to on- premise AD, supports MFA
  • Users are managed on the on-premise AD
• Simple AD
  
  • AD-compatible managed directory on AWS
  • Cannot be joined with on-premise AD