FederatedIdentity

A Cognito-authenticated federated identity presents a valid pool token to receive temporary IAM credentials for the authenticated role. When the role trust condition is broad (authenticated but any provider), any authenticated pool user - regardless of the provider used - receives the role.

An Identity Pool role mapping rule selects a privileged IAM role based on a token claim value the pool user can write (e.g. a custom User Pool attribute updatable via UpdateUserAttributes), enabling self-escalation to the mapped role.

An Identity Pool with AllowUnauthenticatedIdentities=true lets any internet user call GetId + GetCredentialsForIdentity (no credentials required) to receive temporary IAM credentials for the unauthenticated role.

Signing with a key that anchors an auth system forges the trusted identity.

A cert holder whose subject satisfies a Roles Anywhere role trust can CreateSession to obtain that role's temporary credentials.

A principal that can CanExecuteAs the pipeline's service-connection identity, where that identity holds ARM Contributor/Owner at subscription scope, gains a foothold in that Azure subscription.

A WIF service connection lets a pipeline job request a short-lived Azure DevOps OIDC token that is then exchanged for an ARM access token; any code in the job can call the OIDC endpoint.

A managing-tenant ExternalPrincipal named in a resource-group-scoped Lighthouse authorization has CanAdminister over that resource group.

A managing-tenant ExternalPrincipal named in a subscription-scoped Lighthouse authorization has CanEnterSubscription into the customer subscription.

An external CI system (GitHub Actions/GitLab CI/Azure DevOps) with an OIDC/WIF trust into a cloud role/SA can federate in as that identity; escalation roll-ups are federation-chains'.

Federating into a Role homed in an AWS account gives the federated principal a foothold in that account.

A realized external->internal identity mapping whose trust condition an attacker-controlled external identity can satisfy yields federation into the internal identity.

Issuing a certificate from a CA that is the trust anchor of a federation lets the issuer mint a matching external identity and federate in.

An Artifact Registry repo IAM binding for a Workload Identity Federation principalSet/principal with uploadArtifacts grants an external OIDC identity (e.g. GitHub Actions) direct push access - supply-chain from external CI into GCP workloads.

A CSR repo IAM binding for a WIF principalSet/principal with source.repos.update grants an external OIDC identity (e.g. GitHub Actions) direct push access without any long-lived GCP key - supply-chain injection from external CI.

Federating into a WIF-impersonated ServiceAccount gives the external principal a foothold in the SA's home project.

An external identity the WIF provider accepts and a workloadIdentityUser binding resolves can federate into the impersonated ServiceAccount.

A Kubernetes workload-identity binding (KSA<->GSA / IRSA / AKS Workload Identity) lets the pod's projected SA token federate into a cloud Role/ServiceAccount; escalation roll-ups are federation-chains'.