AWS Identity
You can use AWS Identity Services to manage identities, resources, and permissions securely and at scale. For applications running on AWS, you can use fine-grained access controls to grant your employees, applications, and devices the access they need to AWS services and resources within easily deployed governance guardrails. AWS Identity Services provide flexible options for where and how you manage your employee, partner, and customer identities so that you can confidently migrate existing workloads to AWS. For hybrid workload deployments, AWS Identity Services allow you to establish a single identity and access strategy across your on-premises environments and AWS. For customer-facing web and mobile apps, you can use AWS Identity Services to quickly add sign-up and sign-in functionality backed by scalable cloud directories for your app users.
AWS Identity Services for your workforce give you a choice of where to manage the identities and credentials of your employees, and the fine-grained permissions to grant the right access, to the right people, at the right time. AWS Identity Services for your customer-facing applications give your developers more time to build great apps for your customers by enabling them to add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily. With AWS, you have the identity management services you need to get started quickly with the features and capabilities you need to securely manage access to your workloads and applications as you scale.
AWS Identity Services for your workforce
AWS gives you the freedom to choose where to manage the identities and credentials of your employees, and the fine-grained permissions to grant the right access, to the right people, at the right time. With AWS, you have flexible administration capabilities and easy-to-use controls over multi-account environments. AWS helps you implement and enforce the principle of least privilege access with analytic tools that help identify unused permissions across all AWS accounts so that you can remove unnecessary access quickly and confidently.
Benefits
Freedom to choose your identity source
AWS Identity Services allow your identity administrators to create users directly in AWS or to connect to an existing identity source. Your employees can use their existing credentials to sign in and see all their assigned roles for AWS accounts and business applications from one place. With AWS, you can extend your on-premises Microsoft Active Directory (AD) to AWS using AD forest trusts or AD Connector. You then can use your existing AD users and groups to manage access to your AWS accounts and AD-aware workloads such as Amazon RDS for SQL Server, Amazon EC2 for Windows Server, and Amazon WorkSpaces.
Fine-grained access control with analytics
AWS Identity Services enable you to quickly grant the right access, to the right people, at the right time by selecting permissions from a library of AWS managed policies, on which you can base your own custom managed policies. AWS also supports the use of attribute-based access control to define and manage fine-grained, highly customizable user permissions. Finally, AWS helps you continuously improve your security posture by analyzing access patterns and identifying unused permissions across all AWS accounts so that you can remove unnecessary access quickly and confidently.
Flexible administration and governance
AWS Identity Services give you the ability to delegate administrative tasks and automate capabilities, such as account creation, to make it easy to manage large, multi-account AWS environments. With AWS, you also can improve security and maintain compliance by consistently enforcing who can create what type of resource and where. To get started running secure and scalable workloads quickly, you can build a brand new, multi-account environment based on AWS best practices with just a few clicks.
Workforce identity services
Managed Microsoft Active Directory
Securely manage access to AWS services and resources
Simple, secure service to share AWS resources
Central governance and management across AWS accounts
Govern a new, secure, multi-account AWS environment
AWS Identity Services for customer-facing applications
Amazon Cognito helps you create a simple, secure, scalable, and standards-based sign-up and sign-in customer experience for your apps. Amazon Cognito gives your customers the flexibility to use their existing identity providers, social or enterprise, and you save time with easy configurations for federating identity providers. Amazon Cognito allows you to add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily. Your apps will be able to get unique identities for the users and obtain temporary, limited-privilege AWS credentials to access AWS services.
Amazon Verified Permissions is a scalable, fine-grained permissions management and authorization service for custom applications. The service centralizes fine-grained permissions for custom applications and allows developers to authorize user actions within applications.
Benefits
Scalable and easy to use
Amazon Cognito provides a secure user directory that scales to hundreds of millions of users. As a fully managed service, it is easy to set up without standing up server infrastructure.
With a built-in user interface and easy configuration for federating identity providers, Amazon Cognito helps you add user sign-in, sign-up, and access control to your apps in minutes. You can customize the user interface to highlight your company branding in all user interactions.
See how to quickly integrate Amazon Cognito with your apps.
Standards-based social and enterprise identity federation
With Amazon Cognito, your app users can sign in through social identity providers such as Google, Facebook, and Amazon, and through enterprise identity providers via SAML, without having to create and remember additional passwords.
Amazon Cognito is a standards-based identity provider and supports identity and access management standards, such as OAuth 2.0, SAML 2.0, and OpenID Connect.
Read more about federation.
Secure and compliant authentication for your apps
Amazon Cognito supports multi-factor authentication and encryption of data at rest and in transit. It helps you meet multiple security and compliance requirements, including those for highly regulated organizations such as healthcare companies and merchants.
Amazon Cognito is HIPAA eligible and PCI DSS, SOC, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, and ISO 9001 compliant.
Read more about security and compliance.
Amazon Cognito for customer-facing application identity
Identity management for your apps
Amazon Verified Permissions for custom application access management
Fine-grained permissions and authorization for your custom applications
Featured resources
Stay up to date with AWS Online Tech Talks.
Featured customer
GE
“GE uses AWS Identity Services to support their global enterprise and allow their businesses to operate securely in the cloud. AWS Organizations and Service Control Policies (SCP) provide top-down governance and allows for the delegation of identity based and resource-based policy administration to each business unit. This model allows the businesses to move independently and operate at scale to solve today’s industrial challenges.”
Matthew Green, Sr. Director, Cloud Architecture - GE
