What is meant by "IAM user who federated"?

Question

I am struggling to understand the following sentence from the AWS documentation, it all makes sense to me until we get to the end, where it says "who federated":

"When a federated user makes a request, the principal making the request is the federated user ARN and not the ARN of the IAM user who federated."

Document link: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html.

My assumption is that "IAM user who federated" is referring to the IAM user that facilitates the federation process, i.e., the IAM user who configured federation initially. If my assumption is correct, then a small change of " the IAM user who configured federation" would go a long way in making it clearer.

Answer

A federated identity is a user that can access secure AWS account resources with external identities. External identities can come from a corporate identity store (such as LDAP or Windows Active Directory) or from a third party (such as Login in with Amazon, Facebook, or Google). Refer [Federated Identity Overview](https://docs.aws.amazon.com/signin/latest/userguide/federated-identity-overview.html) for more details.

From the [Policy Evaluation Logic](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html) document, i"m picking up the statement as following:

Principal – The user, role, federated user, or application that sent the request. Information about the principal includes the policies that are associated with that principal.

User: IAM User(Native to AWS)
Role: IAM Role(Role created at AWS, can be federated role via trust relationship eg SAML)
Federated User: User whose authentication happens through Identity provider and authorization happens at AWS IAM side thorough trust relationship between IDP and IAM. Users who assume federated role, are also called federated user.

So, "IAM user who federated" means the user who logged in to AWS via authentication through corporate identity store not the user who configured federation.

Hope you find this helpful, let me know if you have any additional questions.

Answer

All it means is that when a user federates their access to AWS, the request or requests they make to AWS resources will be associated with their federated user identity represented by the federated user ARN, rather than the IAM user who facilitated the federated access.

Answer

Hi,
See https://aws.amazon.com/identity/federation/ for a detailled definition

```
Identity federation is a system of trust between two parties for the purpose 
of authenticating users and conveying information needed to authorize their 
access to resources. In this system, an identity provider (IdP) is responsible for 
user authentication, and a service provider (SP), such as a service or an application, 
controls access to resources. By administrative agreement and configuration, the SP 
trusts the IdP to authenticate users and relies on the information provided by the 
IdP about them. After authenticating a user, the IdP sends the SP a message, called 
an assertion, containing the user's sign-in name and other attributes that the SP 
needs to establish a session with the user and to determine the scope of resource 
access that the SP should grant. Federation is a common approach to building access 
control systems which manage users centrally within a central IdP and govern their 
access to multiple applications and services acting as SPs.
```

We have often the case where customers have Active Directory (on-prem or on-cloud) where identities are defined. AD is the IpP in that case. Those users will then user services on AWS under their AD id. So, this AD id is "federated" toward AWS, which trusts AD, and grants access tor resources based on the IAM credentials granted to those federated identities.

What is meant by "IAM user who federated"?

Relevant content