CanFederateAs

An Identity Pool with AllowUnauthenticatedIdentities=true lets any internet user call GetId + GetCredentialsForIdentity (no credentials required) to receive temporary IAM credentials for the unauthenticated role.

A Cognito-authenticated federated identity presents a valid pool token to receive temporary IAM credentials for the authenticated role. When the role trust condition is broad (authenticated but any provider), any authenticated pool user - regardless of the provider used - receives the role.

An Identity Pool role mapping rule selects a privileged IAM role based on a token claim value the pool user can write (e.g. a custom User Pool attribute updatable via UpdateUserAttributes), enabling self-escalation to the mapped role.

An IAM principal with cognito-identity:GetOpenIdTokenForDeveloperIdentity can synthesize a developer-authenticated token for any developerUserId in the pool and exchange it for the authenticated role's IAM credentials, bypassing user authentication entirely.

A Kubernetes ServiceAccount annotated with eks.amazonaws.com/role-arn and a matching IAM role trust policy (Federated = cluster OIDC issuer) lets any pod running as that KSA exchange its projected token for IAM role credentials via sts:AssumeRoleWithWebIdentity. Cites container-chains workload-identity-federates and federation-chains federation-maps-to-identity.

An EKS Pod Identity Association (eks:CreatePodIdentityAssociation) links a Kubernetes namespace:ServiceAccount pair to an IAM role. Pods running as that SA receive IAM credentials from the eks-pod-identity-agent at 169.254.170.23. Whoever can create or modify this association can reroute which IAM role any pod in that namespace:SA binding runs as.

A cert holder whose subject satisfies a Roles Anywhere role trust can CreateSession to obtain that role's temporary credentials.

An external CI system (GitHub Actions/GitLab CI/Azure DevOps) with an OIDC/WIF trust into a cloud role/SA can federate in as that identity; escalation roll-ups are federation-chains'.

A Kubernetes workload-identity binding (KSA<->GSA / IRSA / AKS Workload Identity) lets the pod's projected SA token federate into a cloud Role/ServiceAccount; escalation roll-ups are federation-chains'.

A realized external->internal identity mapping whose trust condition an attacker-controlled external identity can satisfy yields federation into the internal identity.

Issuing a certificate from a CA that is the trust anchor of a federation lets the issuer mint a matching external identity and federate in.

An external identity the WIF provider accepts and a workloadIdentityUser binding resolves can federate into the impersonated ServiceAccount.