Identity providers and federation
If you already manage user identities outside of Amazon, you can use IAM identity providers instead of creating IAM users in your Amazon Web Services account. With an identity provider (IdP), you can manage your user identities outside of Amazon and give these external user identities permissions to use Amazon resources in your account. This is useful if your organization already has its own identity system, such as a corporate user directory. It is also useful if you are creating a mobile app or web application that requires access to Amazon resources.
When you use an IAM identity provider, you don't have to create custom sign-in code or manage your own user identities. The IdP provides that for you. Your external users sign in through a well-known IdP, such as Login with Amazon, Facebook, or Google. You can give those external identities permissions to use Amazon resources in your account. IAM identity providers help keep your Amazon Web Services account secure because you don't have to distribute or embed long-term security credentials, such as access keys, in your application.
To use an IdP, you create an IAM identity provider entity to establish a trust
relationship between your Amazon Web Services account and the IdP. IAM supports IdPs that are compatible
with OpenID Connect (OIDC)
For details about creating the IAM identity provider entity to establish a trust relationship between a compatible IdP and Amazon, see Creating IAM identity providers