This option allows users who have been granted federated access to your AWS resources through a web identity provider to assume these roles instead of via a user that has been created within IAM.
Federated access simply means that the user has been authenticated by an external source, and in the case of web identity federation, this could be via well-known Identity Providers (IdPs) such as Amazon, Google, Facebook, or even Amazon Cognito (which will be discussed later in this chapter). Federation allows a Single Sign-On (SSO) approach.
Before creating a role for a web identity, there are a number of prerequisites that need to be completed:
- You will need to gain either an Application ID or Audience from the IdP, depending on which option you select, by signing up as a developer with the IdP.
- Once you have received the information (application ID or audience), you will then need to set up an OpenID Connect IdP within IAM.
- Finally, you will need to ensure...
