Managing federated user accounts

We've focused primarily on AWS IAM-managed user accounts in this chapter. Recall the distinction between a user account—referring to the AWS IAM user object, which a principal uses to identify itself to access AWS resources—and a principal, which is an end user of the system in a general sense. We've discussed at length how principals may use an AWS IAM-managed user account to access AWS resources; however, that is not the only way principals may do so.

Many organizations manage their own enterprise identities and would prefer to maintain control over the accounts and credentials that employees use when accessing business applications. Similarly, service providers or relying parties benefit from not needing to maintain an account's credentials. As we saw in the Redbeard Identity (RBI) example in Chapter 1, An Introduction to IAM and AWS IAM Concepts, the RBI organization would provision an account into various software...