Identity providers and federation - Amazon Identity and Access Management
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.

Identity providers and federation

If you already manage user identities outside of Amazon, you can use IAM identity providers instead of creating IAM users in your Amazon account. With an identity provider (IdP), you can manage your user identities outside of Amazon and give these external user identities permissions to use Amazon resources in your account. This is useful if your organization already has its own identity system, such as a corporate user directory. It is also useful if you are creating a mobile app or web application that requires access to Amazon resources.

When you use an IAM identity provider, you don't have to create custom sign-in code or manage your own user identities. The IdP provides that for you. Your external users sign in through a well-known IdP, such as Login with Amazon, Facebook, or Google. You can give those external identities permissions to use Amazon resources in your account. IAM identity providers help keep your Amazon account secure because you don't have to distribute or embed long-term security credentials, such as access keys, in your application.

To use an IdP, you create an IAM identity provider entity to establish a trust relationship between your Amazon account and the IdP. IAM supports IdPs that are compatible with OpenID Connect (OIDC) or SAML 2.0 (Security Assertion Markup Language 2.0). For more information about using one of these IdPs with Amazon, see the following sections:

For details about creating the IAM identity provider entity to establish a trust relationship between a compatible IdP and Amazon, see Creating IAM identity providers