🔑 AWS Authentication - Advanced

Cross-Account Access

# Create trust relationship
aws iam update-assume-role-policy-document \
  --role-name CrossAccountRole \
  --policy-document file://trust-policy.json

SAML Federation

# Create SAML provider
aws iam create-saml-provider \
  --saml-metadata-document file://metadata.xml \
  --name OktaSAML

Session Management

import boto3

def assume_role(role_arn, session_duration):
  sts = boto3.client('sts')
  response = sts.assume_role(
    RoleArn=role_arn,
    RoleSessionName='AppSession',
    DurationSeconds=session_duration
  )
  return response['Credentials']

Key Takeaways

• **Cross-account** roles enable delegation

• **Federation** integrates identity systems

• **Temporary credentials** limit exposure

• **Policies** enforce least privilege

Next Steps

Explore advanced scaling and load balancing patterns.