The AWS IAM service is offered as a simple way to build authentication into our application. But, there are some limitations as to what IAM can provide.
The typical limitations of IAM are soft limits. For instance, the number of users we can create in IAM is limited to 5,000, the number of groups to 300, and so on, and if our application is built for the web, we would also expect web-scale user numbers to be supported. When we talk about web-scale, we are talking about hundreds of thousands, millions, and potentially billions of users. To support large sets of individually authenticated users, IAM can be integrated with web identities, Security Assertion Markup Language (SAML), and OpenID-compatible providers. There is built-in support for Amazon, Amazon Cognito, Google, and Facebook web identity providers, but any other compatible provider...
