Security and Microservice Architecture on AWS

Appendix B. Example of a SAML Identity Provider for AWS

In most corporations, upon getting hired, employees typically register with a preferred system of choice, such as Active Directory for their corporate accounts. These companies require their employees to maintain strong security practices around securing their corporate accounts. In Chapter 8, I argued for the need to have individual AWS accounts per team with strong authentication. This means that the large corporations have to maintain multiple sets of identities: one for their corporate accounts within their identity management system of choice, and on top of this, identities within the multiple team-level AWS accounts. This brings about a significant rise in the complexity of management. This also makes it harder for companies to onboard, maintain, or terminate employee identities across all of these accounts.

To avoid such a scenario, security professionals recommend the use of federated identities (see Chapter 2). A federated identity is a portable identity that allows users to be authenticated across multiple systems without having to prove their identity multiple times.

A Hands-On Example of a Federated Identity Setup

AWS allows you to use any compatible identity provider (IdP) to manage the authentication aspect of identity management. Some popular IdPs include Okta, OneLogin, Ping Identity, JumpCloud, and others. Identity federation on AWS can happen using one of two identity federation standards: OpenID Connect ...