Federated and Mobile Access

Even though this is not explicitly called out as one of the items in the exam outline, knowing how to connect your accounts via federated methods will be useful when answering the exam questions. Understanding the concepts of the Security Assertion Markup Language (SAML) and identity providers (IdPs) and how they simplify secure access to your accounts is key. There may be standalone questions related to these concepts or they may be embedded within questions on other topics. This chapter will cover the necessary aspects of these important topics so that when these items come up, both in the exam and in your real-life tasks, you will have the understanding needed to tackle them with confidence.

The following main topics will be covered in this chapter:

• What is federated access?
• Enabling SSO with corporate account identities using SAML
• Social federation
• Amazon Cognito

Technical Requirements

You must have a basic understanding of AWS services and networking concepts.

What Is Federated Access?

In the context of AWS, federated access refers to a mechanism that allows users to access AWS resources using their existing identity and credentials from an external IdP. It enables users to authenticate and authorize their access to AWS services without the need for separate AWS-specific credentials.

In a typical federated access scenario, the user’s identity is managed by an external IdP, such as Microsoft Azure Active Directory, Okta, or an on-premises identity system. The IdP serves as a trusted authority that authenticates the user and issues security tokens to represent the user’s identity.

When a user attempts to access AWS resources, they are redirected to the IdP for authentication. Once the user’s identity is verified, the IdP issues an access token or security assertion, such as a SAML token or an OpenID Connect (OIDC) token. This token contains the necessary information to identify the user and specify their access rights...

Enabling SSO with Corporate Account Identities Using SAML

IAM Identity Center enables identity federation using the widely adopted SAML 2.0 standard. SAML 2.0 allows the secure exchange of user information between an IdP and a service provider (SP). With IAM Identity Center, authorized users can enjoy federated SSO access to applications within the AWS Management Console.

By integrating SAML IdP capabilities into your managed Microsoft AD or IAM Identity Center identity store, users can seamlessly sign in to SAML-supported services. This includes the AWS Management Console and popular third-party applications such as Microsoft 365, SAP Concur, and Salesforce. IAM Identity Center leverages the exchanged SAML assertions to facilitate a smooth and secure user experience across multiple platforms.

While SAML is primarily used within an enterprise environment, you may want to have outside users gain specific access to data or services in your account. Social federation can be of help...

Understanding the Amazon Cognito Service

Amazon Cognito is a service that simplifies and secures user authentication and management in various applications, such as web, mobile, and Internet of Things (IoT) applications. The benefits of the Cognito service can be summed up as follows:

• User experience and engagement: Amazon Cognito helps improve the user experience in applications by providing a seamless and secure authentication process. It ensures that users can easily register and sign in to your applications using their preferred methods, such as usernames and passwords or social media accounts. This enhances user engagement and satisfaction, increasing your applications’ adoption and usage.
• Security and compliance: Cognito offers robust security features to protect user accounts and sensitive data. It supports multi-factor authentication (MFA), ensuring an extra layer of security beyond passwords. It also helps organizations comply with security and privacy regulations...

Summary

In this chapter, you looked at federated access, what it is, and when (and when not) to use it. You also learned about SAML and how it is primarily used for enterprise federations where trusted entities exchange authentication and authorization data.

Finally, as the chapter wrapped up, you reviewed the Amazon Cognito service. You read in depth about the differences between user pools and identity pools and went through the job function for each pool type. You saw how, once a user is authenticated to a user pool, they are issued a JWT. You also learned how user data is stored in the JWT for later use in the user pool.

In the next chapter, you will look extensively at AWS Directory Service and the different varieties of it available to you in AWS.

Further Reading

For additional information on AWS security, please check out the following resources:

• AWS Cognito FAQs: https://packt.link/oHgXr
• The Web Identity Federation Playground (an interactive website to test authentication): https://packt.link/8PVv9
• The Shared Responsibility Model: https://packt.link/NcebR

Exam Readiness Drill – Chapter Review Questions

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That is why working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

How To Access These Resources

To learn how to access these resources, head over to the chapter titled Chapter 21, Accessing the Online Practice Resources.

To open the Chapter Review Questions for this chapter, perform the following steps:

1. Click the link – https://packt.link/SCSC02E2_CH15

   Alternatively, you can scan the following QR code (Figure 15.3):

Figure 15.3: QR code that opens Chapter Review Questions...