This recipe will show you how to federate identities from your Active Directory and use AD groups and IAM roles to provide different levels of access to multiple AWS accounts.
At a high level, we're going to have an AWS account that is designated as an Auth Account. Users will log in to this account and be assigned a role. This role will have next to no privileges because we don't want them doing anything in the Auth Account. However, they will be able to use role switching to access another AWS account; we'll call this the App Account.
This is a reasonably common pattern whereby users will have access to a number of AWS accounts and use role switching to jump between them—all using credentials that are verified against an AD backend and a level of access that is derived from AD groups.
