Lesson 06 — Identity Federation

Learning Objectives

By the end of this lesson, you will be able to:

Understand Identity Federation
Learn why enterprises use federated identities
Understand Identity Providers (IdPs)
Learn how OpenID Connect (OIDC) works
Understand Security Assertion Markup Language (SAML)
Explore AWS IAM Identity Center integration
Understand enterprise authentication architecture
Apply federation security best practices

Why This Matters

Modern organisations rarely create separate usernames and passwords for every application.

Imagine an enterprise with:

AWS Management Console
Amazon EKS
Microsoft 365
GitHub Enterprise
Jira
ServiceNow
Salesforce
VPN
Internal Applications

Without federation:

Each employee would need a separate account for every application.

This creates:

Password fatigue
Increased support costs
Weak password reuse
Difficult user management
Higher security risks

Identity Federation solves these challenges by allowing users to authenticate once using a trusted identity provider and securely access multiple systems.

What is Identity Federation?

Identity Federation is the process of trusting an external Identity Provider (IdP) to authenticate users instead of maintaining separate user accounts within every application.

Instead of Kubernetes storing usernames and passwords, authentication is delegated to an enterprise identity platform.

User

↓

Identity Provider

↓

Verified Identity

↓

Amazon EKS

↓

Kubernetes Access

The Kubernetes cluster trusts the identity verified by the external provider.

Benefits of Identity Federation

Identity Federation provides:

Single Sign-On (SSO)
Centralised identity management
Improved user experience
Stronger security
Multi-Factor Authentication (MFA)
Simplified onboarding
Simplified offboarding
Reduced password reuse
Better compliance
Centralised auditing

Most enterprise cloud environments use federated identity.

Federation vs Local Accounts

Local Accounts	Federated Identity
Separate credentials	Corporate credentials
Multiple passwords	Single Sign-On (SSO)
Difficult to manage	Centralised management
Individual account lifecycle	Automated provisioning
Manual access removal	Centralised offboarding

Federation significantly reduces administrative overhead.

Identity Federation Architecture

User

↓

Corporate Identity Provider

↓

Authentication

↓

Amazon EKS

↓

RBAC Authorization

↓

Cluster Resources

Authentication happens outside Kubernetes.

Authorization still occurs inside Kubernetes using RBAC.

Enterprise Identity Providers (IdPs)

Common Identity Providers include:

Microsoft Entra ID
Okta
Ping Identity
Google Workspace
OneLogin
Keycloak
Active Directory Federation Services (AD FS)

These platforms manage user identities centrally across the organisation.

Single Sign-On (SSO)

Single Sign-On allows users to authenticate once and access multiple services.

Employee Login

↓

Identity Provider

↓

Authenticated

↓

AWS Console

↓

Amazon EKS

↓

GitHub

↓

Jira

Users no longer need separate passwords for every platform.

Multi-Factor Authentication (MFA)

Federated authentication commonly requires MFA.

Example:

Username

↓

Password

↓

Authenticator App

↓

Authenticated

MFA dramatically reduces the likelihood of credential compromise.

OpenID Connect (OIDC)

OpenID Connect (OIDC) is the most common federation protocol used by Amazon EKS.

OIDC provides:

Identity verification
Authentication tokens
Secure federation
Token-based authentication

Authentication flow:

User

↓

Identity Provider

↓

OIDC Token

↓

Amazon EKS

↓

Authenticated

OIDC is lightweight, modern, and cloud-native.

JSON Web Tokens (JWT)

OIDC authentication uses JSON Web Tokens (JWTs).

A JWT contains claims about the authenticated user, such as:

User ID
Email address
Group membership
Token expiration
Issuing authority

User Login

↓

JWT Issued

↓

Amazon EKS Validates Token

↓

Access Granted

JWTs are digitally signed to prevent tampering.

Security Assertion Markup Language (SAML)

Many enterprise Identity Providers also support SAML.

SAML is an XML-based federation protocol widely used in enterprise environments.

Employee

↓

Corporate Identity Provider

↓

SAML Assertion

↓

AWS IAM Identity Center

↓

Amazon EKS

Although OIDC is more common for cloud-native applications, SAML remains important for enterprise integrations.

AWS IAM Identity Center

AWS IAM Identity Center provides centralised workforce authentication for AWS environments.

It integrates with:

Microsoft Entra ID
Okta
Active Directory
Google Workspace
Ping Identity

Architecture:

Employee

↓

Corporate Login

↓

IAM Identity Center

↓

AWS IAM Role

↓

Amazon EKS

This simplifies user management across AWS accounts and Kubernetes clusters.

Federation in Amazon EKS

Authentication process:

User

↓

Identity Provider

↓

IAM Identity Center

↓

AWS IAM Role

↓

AWS STS

↓

Amazon EKS

↓

RBAC

Identity is verified before Kubernetes evaluates permissions.

AWS Security Token Service (STS)

AWS STS issues temporary credentials after successful authentication.

Identity Provider

↓

AWS STS

↓

Temporary Credentials

↓

Amazon EKS

Benefits include:

Temporary access
Automatic expiration
Reduced credential theft
Better auditing

Long-lived credentials should be avoided wherever possible.

Federation for Applications

Identity Federation is not limited to human users.

Applications also authenticate using federation.

Example:

Application

↓

Service Account

↓

OIDC Provider

↓

AWS STS

↓

Temporary Credentials

This architecture underpins IAM Roles for Service Accounts (IRSA), which you will explore in the next lesson.

Enterprise Federation Architecture

Employee

↓

Microsoft Entra ID

↓

IAM Identity Center

↓

AWS IAM Role

↓

AWS STS

↓

Amazon EKS

↓

RBAC

↓

Production Cluster

Every authentication request is centrally managed and audited.

Enterprise Example

A multinational healthcare provider operates Amazon EKS across several AWS accounts.

Authentication architecture:

Doctor

↓

Microsoft Entra ID

↓

MFA

↓

IAM Identity Center

↓

AWS IAM Role

↓

AWS STS

↓

Amazon EKS

↓

RBAC

↓

Patient Management System

Benefits include:

Single Sign-On
Centralised account management
Immediate account revocation
MFA enforcement
Temporary credentials
Comprehensive audit logging

This approach simplifies operations while improving security.

Identity Federation Security Risks

Cloud Security Engineers frequently identify:

Missing MFA
Weak Identity Provider configuration
Long-lived credentials
Excessive IAM permissions
Misconfigured trust relationships
Expired certificates
Stolen authentication tokens
Shared administrator accounts
Inactive user accounts
Unmonitored federation events

Weak federation controls can allow attackers to gain unauthorised access to enterprise environments.

Enterprise Monitoring

Security teams should monitor:

User login events
Failed authentication attempts
MFA failures
Identity Provider configuration changes
AWS STS AssumeRole events
OIDC authentication events
SAML authentication events
IAM Role assumptions
New federated identities
Suspicious authentication patterns

CloudTrail and GuardDuty provide visibility into identity-related activity.

Best Practices

As a Kubernetes Security Engineer:

Use enterprise Identity Providers for authentication.
Enable Single Sign-On (SSO).
Require Multi-Factor Authentication.
Use OIDC for cloud-native authentication.
Prefer temporary credentials over long-lived access keys.
Integrate Amazon EKS with AWS IAM Identity Center.
Regularly review federation trust relationships.
Monitor authentication events continuously.
Remove inactive identities promptly.
Apply the Principle of Least Privilege.

Identity Federation should be the standard authentication model for enterprise Kubernetes environments.

Real-World Scenario

A company uses local Kubernetes administrator accounts with shared passwords instead of federated identities.

An employee leaves the organisation, but their account remains active.

Months later, the credentials are used by an attacker to:

Access Amazon EKS.
Read Kubernetes Secrets.
Deploy malicious workloads.
Disable security monitoring.

If Identity Federation had been implemented:

The employee’s corporate account would have been disabled centrally.
Access to Amazon EKS would have been revoked immediately.
MFA would have prevented many credential-based attacks.
Every authentication event would have been centrally audited.

Key Takeaways

After completing this lesson, you should understand:

What Identity Federation is
Why enterprises use federated authentication
The role of Identity Providers
How Single Sign-On improves usability and security
How OpenID Connect (OIDC) and SAML enable federation
The role of AWS IAM Identity Center and AWS STS
Common federation security risks
Best practices for securing federated identities

Identity Federation provides a scalable and secure authentication model for modern Kubernetes environments, enabling organisations to centralise identity management while maintaining strong security controls.

Knowledge Check

Question 1

What is the primary purpose of Identity Federation?

A. Increase Pod performance
B. Centralise authentication using a trusted Identity Provider
C. Replace Kubernetes RBAC
D. Encrypt Kubernetes Secrets

Answer: B

Question 2

Which protocol is most commonly used for cloud-native authentication with Amazon EKS?

A. FTP
B. SMTP
C. OpenID Connect (OIDC)
D. SNMP

Answer: C

Question 3

Which AWS service provides centralised workforce authentication for AWS environments?

A. Amazon Inspector
B. AWS IAM Identity Center
C. Amazon Route 53
D. Amazon ECR

Answer: B

Question 4

What is the primary benefit of Single Sign-On (SSO)?

A. Higher CPU performance
B. One login provides access to multiple trusted applications
C. Faster Pod scheduling
D. Larger Kubernetes clusters

Answer: B

Question 5

Which AWS service issues temporary credentials after successful federated authentication?

A. Amazon S3
B. AWS Security Token Service (STS)
C. Amazon CloudWatch
D. AWS Config

Answer: B

What’s Next?

In the next lesson, you will learn about IAM Roles for Service Accounts (IRSA), exploring how Amazon EKS enables Kubernetes workloads to securely access AWS services using OIDC, AWS STS, and temporary IAM credentials, eliminating the need for long-lived AWS access keys.

➡️ Next Lesson: Lesson 07 — IAM Roles for Service Accounts (IRSA)