Instiq
Chapter 4 · Identity and Access Management·v2.0.0·Updated 6/5/2026·~10 min

What's changed: Deepened SCS-C02 Chapter 4 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)

4.2Federation and Cross-Account Access

Key points

Understand temporary credentials and federation—IAM roles (AssumeRole), SAML/OIDC federation, IAM Identity Center, ExternalId, and STS. Delegate securely without long-lived keys.

Secure access uses temporary credentials. Avoid long-lived keys; use role assumption and federation.

4.2.1Temporary credentials and federation

Diagram of AWS federation and cross-account: obtain temporary credentials from a corporate IdP (Active Directory/external IdP) via SAML/OIDC federation or IAM Identity Center; access another account’s resources by assuming an IAM role with sts:AssumeRole (trust policy defines who may assume); use an ExternalId condition for third parties to prevent the confused-deputy problem; all operating on STS temporary credentials without long-lived access keys.
Federation and cross-account
  • AssumeRole/STS: assume a role for temporary credentials (no long-lived keys).
  • SAML/OIDC federation: access AWS with existing corporate IdP identities.
  • IAM Identity Center: centralize SSO and permission sets across accounts.
  • Trust policy/ExternalId: define who can assume; use ExternalId for third parties to prevent the confused-deputy problem.
Exam point

Common on SCS-C02: temporary credentials = AssumeRole/STS (no long-lived keys), corporate IdP = SAML/OIDC federation, multi-account SSO = IAM Identity Center, third parties = ExternalId to prevent confused deputy. A cross-account role needs both a trust policy (who) and a permissions policy (what).

Continue reading — free sign-up

You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.

Get started freeLog in