SAP-C02
Deep Dive
Managing identities in enterprise environments with hundreds of AWS accounts requires centralized federation. IAM Identity Center, Cross-Account Roles, and the different federation mechanisms are heavily weighted topics on the SAP-C02.
Contents
IAM Identity Center is the recommended service for managing centralized access to multiple AWS accounts and SaaS applications from a single point. It replaces manually managing IAM users in every account.
It's the successor to AWS Single Sign-On (SSO). On the SAP-C02 exam it still appears as "AWS SSO" in some questions.
Supported Identity Sources
Identity Center Directory
Identity Center's built-in directory. For companies without their own IdP. Direct management of users and groups.
Active Directory (AD)
Connects with AWS Managed AD or on-premises AD via AD Connector. Syncs users and groups.
External IdP (SAML 2.0)
Connects with Okta, Azure AD, PingFederate, etc. Identity Center acts as the SP (Service Provider).
Authentication flow
The user accesses the Identity Center portal
Identity Center authenticates against the configured Identity Source
The user selects an AWS account and Permission Set
Identity Center assumes the corresponding IAM role via STS
The user gets temporary credentials (AssumeRoleWithSAML)
The Cross-Account Access mechanism lets a principal (user, role, service) in Account-A assume a role in Account-B via STS AssumeRole.
| Element | Where it's configured | What it does |
|---|---|---|
| Role's Trust Policy | Account-B (where the role lives) | Defines who can assume the role (Principal: account-A, user, role) |
| Role's Permissions Policy | Account-B (where the role lives) | Defines what the role can do once assumed in account-B |
| sts:AssumeRole permission | Account-A (where the caller lives) | IAM policy that allows the principal to call sts:AssumeRole |
| ExternalId (optional) | Role's Trust Policy in Account-B | Prevents the Confused Deputy Problem when third parties assume the role |
Confused Deputy Problem
When a third-party service has permission to assume a role in your account, a malicious actor could trick that service into assuming your role. Solution: ExternalId — a secret known only to you and the third party, required in the Trust Policy. Without the correct ExternalId, the AssumeRole fails.
SAML 2.0 — federation for employees
For companies with Active Directory or a corporate IdP (Okta, ADFS). Users authenticate against the IdP and receive a SAML assertion that AWS STS exchanges for temporary credentials.
OIDC — federation for web/mobile applications
For applications using Google, Facebook, Cognito, GitHub, etc. as the Identity Provider. The user authenticates with the OIDC IdP and gets an ID token that AWS STS exchanges for credentials.
| Service | Type | Own AD required | Best for |
|---|---|---|---|
| AWS Managed Microsoft AD | Full AD in AWS (managed) | No — AWS creates and manages it | Companies migrating to AWS that need an AD in the cloud. Supports trust with on-premises AD. |
| AD Connector | Proxy to on-premises AD | Yes — the on-premises AD must exist | Redirecting authentication to an existing AD without syncing users. No local cache. |
| Simple AD | AD-compatible (Samba 4) | No — AWS creates Samba 4 | Small organizations. No trust with real AD, no MFA, no RDS SQL Server support. |
AD Connector vs Managed AD — the exam key
If the scenario says "keep the on-premises AD as the source of truth and don't sync users to AWS" → AD Connector. If it says "need a full AD in AWS with trust to on-premises" → Managed Microsoft AD.
Permission Sets are permission templates that IAM Identity Center deploys as IAM roles in each account. They let you manage access across hundreds of accounts from a central point without modifying individual roles.
Permission Set characteristics
Example structure in an org
Trap: "IAM Identity Center creates IAM Users in every account"
Reality: FALSE. Identity Center manages temporary access via IAM roles. It does not create or sync IAM users in member accounts.
Trap: "AD Connector syncs on-premises users into AWS"
Reality: FALSE. AD Connector is just a proxy — it redirects authentication requests to the on-premises AD without storing users or passwords in AWS.
Trap: "AssumeRoleWithSAML creates permanent credentials"
Reality: FALSE. STS always issues temporary credentials (access key + secret key + session token). Maximum 12 hours with MaxSessionDuration.
Trap: "Permission Sets are IAM roles in Identity Center"
Reality: They're templates. The actual IAM roles are created in each member account when the Permission Set is assigned.
Did you get this topic?
Test what you just learned
A company uses on-premises Active Directory as the source of truth for identities. They have 300 AWS accounts and want employees to access the right accounts using their corporate AD credentials, without creating IAM users in every account. What is the most appropriate and scalable solution?
Put what you learned to the test with original SAP-C02 exam questions.
Start SAP-C02 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.