Federation, Assumed Roles and Programmatic Access

What it is

Every call to an AWS API must be signed with credentials. The safest credentials are temporary: an access key ID, a secret access key and a session token that expire on their own.

This page covers four skills that all lead to the same goal. Federation lets users from another identity system get AWS access. Assuming a role is the mechanism that hands out the temporary credentials. Programmatic access is how your code finds them, and a signed call is how it uses them.

How it works

Identity federation

Federation means users sign in with an identity that lives outside IAM and still receive AWS permissions through an IAM role.

A user pool authenticates and returns tokens. It does not give AWS credentials. An identity pool takes a token from a user pool, a social provider or a SAML or OIDC provider and exchanges it for AWS credentials. It can also issue guest credentials for unauthenticated users, mapped to a separate, more restricted role.

AssumeRoleWithSAML and AssumeRoleWithWebIdentity need no AWS credentials to call, because the identity provider's token is the proof.

Assuming a role

A role has no password or long term keys. A caller asks the AWS Security Token Service (STS) to assume it by calling AssumeRole. STS returns temporary credentials with an expiration time.

Two policies must agree. The role's trust policy names who may assume it. The caller's own identity policy must allow sts:AssumeRole on the role. For a different account, both sides must allow it.

• External ID: a shared value that a third party supplies when assuming your role. It protects against the confused deputy problem.
• Session duration: the default is one hour. A role can set a maximum session duration of 1 to 12 hours. Role chaining (a role assuming another role) is limited to one hour.
• Passing a role to a service: to attach a role to Lambda, ECS or EC2, your identity needs iam:PassRole for that role.

Programmatic access

Code finds credentials through the credential provider chain. The SDK checks sources in a fixed order and uses the first one that works. In general, environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) come before shared files, and container or instance credentials come last.

A profile can include role_arn and source_profile, and the SDK then calls AssumeRole for you and refreshes the credentials.

Authenticated calls

AWS APIs use Signature Version 4 (SigV4). The SDK and CLI sign every request for you, using the credentials, the Region, the service name and a timestamp. When you call a service with a raw HTTP client, such as an API Gateway endpoint that uses IAM authorization, you must sign the request yourself with the service name execute-api.

How the exam asks about this

• "A mobile app must let signed in users upload directly to an S3 bucket with least privilege" -> a Cognito user pool for sign in plus an identity pool that issues temporary credentials for a scoped role.
• "A Lambda function needs to call a service in another account" -> assume a role in that account with AssumeRole; the role's trust policy must trust the function's execution role.
• "A script on an EC2 instance contains an access key and fails an audit" -> remove the key and use an instance profile.