Authentication Strategies

Establishing who the caller is: IAM Identity Center and permission sets as the answer for human access at scale, SAML 2.0 and OIDC federation mechanics, Cognito user pools versus identity pools, the Directory Service options, MFA enforcement that actually fails closed, root user credential management — and a diagnostic method for when sign-in breaks.

Content current as of 2026-10.

Lessons

1. IAM Identity Center and federation
2. Cognito: user pools and identity pools
3. Directory Service, MFA, and the root user
4. Troubleshooting authentication

Sources

• SCS-C03 exam guide — Content Domain 4 (tasks 4.1–4.2)
• AWS IAM Identity Center user guide — permission sets
• Amazon Cognito developer guide — user pools and identity pools
• IAM User Guide — AWS global condition context keys
• IAM User Guide — centralize root access for member accounts