Trusted identity propagation
overview
Trusted identity propagation enables AWS services to grant permissions based on user attributes such as group associations, add context to an IAM role identifying the user requesting access to AWS resources, and propagate this context to other AWS services.
Benefits of trusted identity
propagation
Trusted identity propagation is a feature of IAM Identity Center that allows the administrators of AWS services to grant permissions to resources, such as data, using the corporate identities of your workforce. In addition, they can audit who accessed what data by looking at service logs or AWS CloudTrail. The administrators of AWS services that support trusted identity propagation may reach out to you to request you enable the feature in IAM Identity Center.
Enabling trusted identity propagation
The process of enabling trusted identity propagation involves the following two steps:
-
Enable IAM Identity Center and connect your existing source of identities to IAM Identity Center - You'll continue to manage your workforce identities in your existing source of identities; connecting it to IAM Identity Center creates a reference to your workforce that all AWS services in your use case can share. It's also available for data owners to use in future use cases.
-
Connect the AWS services in your use case to IAM Identity Center - The administrator of each AWS service in the trusted identity propagation use case follows the guidance in the respective service documentation to connect the service to IAM Identity Center.
Note
If your use case involves a third-party or customer developed application, you enable trusted identity propagation by configuring a trust relationship between the identity provider that authenticates the application users and IAM Identity Center. This allows your application to take advantage of the trusted identity propagation flow previously described.
For more information, see Using applications with a trusted token issuer.
How trusted identity propagation works
The following diagram shows the high-level workflow for trusted identity propagation:

-
Users authenticate with a client-facing application, for example Amazon QuickSight.
-
The client-facing application requests access to use an AWS service to query data and includes information on the user.
Note
Some trusted identity propagation use cases involve tools that interact with AWS services using service drivers. You can find out if this applies to your use case in the use case guidance.
-
The AWS service verifies the user identity with IAM Identity Center and compares the user attributes, like their group associations, with those required for access. The AWS service authorizes the access so long as the user or their group has the necessary permissions.
-
AWS services may log the user identifier in AWS CloudTrail and in their service logs. Check the service documentation for details.
The following image provides an overview of the previously described steps in the trusted identity propagation workflow:
