AWS Identity Federation: When to Choose SAML, OIDC, or Cognito
Compare AWS Identity Federation methods including SAML 2.0, OIDC, and Cognito, and learn optimal selection criteria for each scenario.
Related Exam Domains
- Domain 1: Design Secure Architectures
Key Takeaway
Identity Federation allows access to AWS resources using external credentials (enterprise AD, social logins, etc.). For enterprise IdP (Active Directory), use SAML 2.0; for mobile/web app social logins, use Cognito; for multi-account SSO, use IAM Identity Center.
Exam Tip
Exam Essential: "Enterprise AD → SAML 2.0", "Mobile/Web social login → Cognito", "Multi AWS account SSO → IAM Identity Center"
What is Identity Federation?
A mechanism that allows users authenticated by external Identity Providers (IdP) to access AWS resources without separate IAM users.
Traditional Approach (Not Recommended):
Create IAM user for each external user → Credential management burden
Federation Approach (Recommended):
External IdP authentication → STS temporary credentials issued → Access AWS resources
Why Use Federation?
| Reason | Description |
|---|---|
| Enhanced Security | No need for IAM users/long-term credentials |
| Central Management | Manage users in existing IdP (AD, Okta, etc.) |
| Temporary Credentials | Time-limited tokens via STS |
| Compliance | Consistent application of enterprise security policies |
Federation Types Comparison
| Type | Protocol | Use Case | STS API |
|---|---|---|---|
| SAML 2.0 | SAML | Enterprise IdP (AD) → AWS Console/API | AssumeRoleWithSAML |
| Web Identity (OIDC) | OIDC | Mobile/Web app social login | AssumeRoleWithWebIdentity |
| Cognito | OIDC/SAML | Mobile/Web apps (Recommended) | Cognito SDK |
| Custom Identity Broker | Custom | Non-SAML IdPs | AssumeRole / GetFederationToken |
SAML 2.0 Federation
Integrate AWS with enterprise Active Directory, Okta, ADFS, and other SAML 2.0 supporting IdPs.
How It Works
[User] → [Enterprise IdP (AD/ADFS)]
│
│ Issues SAML Assertion
▼
[AWS STS]
│ AssumeRoleWithSAML
│ Returns temporary credentials
▼
[Access AWS Resources]
AWS Console SSO Flow
1. User → Login to enterprise IdP portal
2. IdP → Creates SAML Assertion
3. Browser → Sends Assertion to AWS SSO endpoint
4. STS → AssumeRoleWithSAML → Temporary credentials
5. Redirect to AWS Console (login complete)
Configuration Components
| Component | Description |
|---|---|
| IAM Identity Provider | Register SAML IdP metadata |
| IAM Role | Role for federation (specify SAML provider in trust policy) |
| IdP Configuration | Register AWS as service provider |
Exam Tip
SAML 2.0 Federation Keywords: "Enterprise Active Directory", "On-premises IdP", "AWS Console SSO", "ADFS" → Choose SAML 2.0
Web Identity Federation (OIDC)
Allow users authenticated by Google, Facebook, Amazon and other OIDC (OpenID Connect) providers to access AWS.
How It Works
[Mobile App] → [Social IdP (Google/Facebook)]
│
│ Issues ID Token (OIDC)
▼
[AWS STS]
│ AssumeRoleWithWebIdentity
│ Returns temporary credentials
▼
[S3, DynamoDB, etc.]
Direct Use vs Cognito
| Aspect | Direct STS Call | Cognito (Recommended) |
|---|---|---|
| API | AssumeRoleWithWebIdentity | Cognito SDK |
| IdP Management | Handle directly | Cognito mediates |
| Anonymous Access | Not possible | Possible (Unauthenticated) |
| Multi-IdP Integration | Complex | Simple |
Exam Tip
AWS Recommendation: For Web Identity Federation, use Amazon Cognito instead of calling STS directly.
Federation with Amazon Cognito
Cognito Components
┌──────────────────────────────────────────┐
│ Amazon Cognito │
│ │
│ ┌─────────────┐ ┌──────────────────┐ │
│ │ User Pool │ │ Identity Pool │ │
│ │ (AuthN) │ │ (AuthZ) │ │
│ │ │ │ │ │
│ │ - Sign-up │ │ - IAM role mapping│ │
│ │ - Login │ │ - Temp credentials│ │
│ │ - JWT issue │ │ - Auth/Unauth roles│ │
│ └─────────────┘ └──────────────────┘ │
└──────────────────────────────────────────┘
User Pool vs Identity Pool
| Aspect | User Pool | Identity Pool |
|---|---|---|
| Role | Authentication | Authorization |
| Result | JWT token issuance | AWS temporary credentials |
| IdP Integration | Google, Facebook, SAML | User Pool, Social IdPs |
| Use Case | Login/Signup | Direct AWS resource access |
Complete Flow
1. User → Login to Cognito User Pool (or Social IdP)
2. User Pool → Issues JWT token
3. JWT → Passed to Cognito Identity Pool
4. Identity Pool → Exchanges for temporary AWS credentials from STS
5. User → Direct access to S3, DynamoDB, etc.
Exam Tip
User Pool = Authentication (Login), Identity Pool = AWS credential issuance. This distinction is frequently tested on exams.
Custom Identity Broker
Method used when using legacy IdPs that don't support SAML 2.0.
[User] → [Legacy IdP]
│
▼
[Custom Identity Broker] ← Develop yourself
│
│ Call AssumeRole or
│ GetFederationToken
▼
[AWS STS] → Returns temporary credentials
| STS API | Purpose |
|---|---|
AssumeRole | Temporary credentials for specific IAM role |
GetFederationToken | Temporary credentials based on custom policy |
Scenario-Based Selection Guide
Federation Method Selection:
│
▼
Enterprise IdP (AD/Okta) for AWS Console SSO?
│
Yes → Multiple AWS accounts? ─ Yes → [IAM Identity Center]
│ No → [SAML 2.0]
No
│
▼
Mobile/Web app user authentication?
│
Yes → [Amazon Cognito] (Recommended)
│
No
│
▼
Non-SAML legacy IdP?
│
Yes → [Custom Identity Broker]
Key STS APIs Summary
| API | Use Scenario |
|---|---|
AssumeRole | Cross-account access, EC2 roles |
AssumeRoleWithSAML | SAML 2.0 Federation |
AssumeRoleWithWebIdentity | OIDC/Social IdP (Cognito recommended) |
GetSessionToken | Temporary token with MFA |
GetFederationToken | Used by Custom Broker |
SAA-C03 Exam Focus Points
- ✅ SAML 2.0: "Enterprise AD/ADFS → AWS Console SSO = SAML 2.0"
- ✅ Cognito Distinction: "User Pool = Authentication, Identity Pool = AWS credentials"
- ✅ Web Identity Recommendation: "Social login → Use Cognito (not direct STS)"
- ✅ Temporary Credentials: "Federation always uses temporary credentials via STS"
- ✅ Custom Broker: "Non-SAML IdP → Custom Identity Broker"
Exam Tip
Sample Exam Question: "On-premises Active Directory users need SSO access to AWS Console. How should this be configured?" → Answer: SAML 2.0 Federation (ADFS → AssumeRoleWithSAML)
Frequently Asked Questions (FAQ)
Q: What's the difference between SAML 2.0 and OIDC?
SAML 2.0 is XML-based and primarily used in enterprise environments (AD, ADFS). OIDC is JSON/JWT-based and suitable for mobile/web app social logins.
Q: Can I access AWS resources using only Cognito User Pool?
No. User Pool only issues JWT tokens. To directly access AWS resources (S3, DynamoDB, etc.), you need to get temporary AWS credentials through Identity Pool.
Q: What is the validity period of temporary credentials issued via Federation?
Default is 1 hour. AssumeRole can be set up to 12 hours, and GetFederationToken up to 36 hours.
Q: What's the difference between IAM Identity Center and direct SAML 2.0 integration?
IAM Identity Center centrally manages SSO for multiple AWS accounts. For single accounts, direct SAML integration is simpler, but IAM Identity Center is recommended for multi-account environments.
Q: Does Cognito support SAML?
Yes. Cognito User Pool can integrate with both SAML 2.0 and OIDC IdPs. You can manage enterprise users (SAML) and social login users (OIDC) in a single User Pool.