Advanced Identity

Question 1

STS

Answer 1

Security Token Service

• Create temporary, limited priv creds for access to AWS resources
• short term credentials - you configure expiry
• Security key and session key
• • identity federation
• • Iam roles for cross/same account access
• • IAM roles for EC2 for temporary credentials

Question 2

Amazon Cognito

Answer 2

• Identity for web and mobile application users
• (potentially millions)
• IAM users are only for people that need to use AWS
• create user in Cognito
• social sign-in

Question 3

Microsoft AD

Answer 3

Active Directory

• Found on any windows server with AD domain services
• database of objects - user accounts, computers, printers, file shared, security groups
• centralized security management, create account, assign permissions

Question 4

Amazon Directory Services

Answer 4

• Can extend AD, AWS managed Microsoft AD
• • create AD in AWS, supports MFA
• • create trust between that an on-prem AD
• AD Connector
• • proxy to redirect to on-prem AD, supports MFA
• • users live on-prem
• Simple AD
• • AD compatible managed directory on AWS
• • Cannot be joined with on-prem

Question 5

AWS IAM Identity Center

Answer 5

Successor to single sign-on
* one login for all
* * AWS accounts in AWS orgs
* * business cloud apps (salesforce, box)
* * SAML 2.0
* * EC2 windows

• Identity providers
• • built in identity store
• • 3rd party (OneLogin, Okta, etc.)