How do federated identities differ from IAM users at Cloud Practitioner depth?
Select an answer to reveal the explanation.
Short Explanation
An IAM user lives inside AWS's own directory. Federation means you already proved who you are to Active Directory or another IdP, and AWS trusts that handshake. Same destination (AWS access), different front door.
Full Explanation
Federation uses an external identity provider for authentication, while an IAM user is an identity defined and managed inside IAM. An IAM user lives inside AWS's own directory; federation means you already proved who you are to Active Directory or another IdP, and AWS trusts that handshake. Same destination — AWS access — different front door. It is false that federated identities can only manage billing while IAM users can only manage VPCs. IAM users do not always require AWS Organizations, and federation can use MFA via the IdP or additional AWS controls. Federation does not disable CloudTrail; IAM users do not uniquely enable it. Distractors fail by inventing service-scope splits, Organizations prerequisites, MFA bans, or CloudTrail side effects. Exam caveat: federated sessions still authorize through IAM roles or Identity Center permission sets that must follow least privilege. Operational check: document whether each persona is IAM-native or federated, prefer federation for workforce scale, ensure CloudTrail captures AssumeRole or Identity Center events, and align MFA requirements with the IdP. In practice, diagram workforce access as IdP-authenticated federation into roles, reserve IAM users for break-glass or tightly justified exceptions, and ensure both paths produce CloudTrail evidence.