So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either term quite liberally here) being claimed by an app can be verified (i.e. app authentication). I am guessing this authentication occurs against the "AWS fabric" and not the target service/resource the app wants to access.
Can anyone share details of how an app establishes its identity and how the "fabric" verifies the identity?
Azure has the notion of managed service identities (based on system assigned identity and VM extensions).
- What's the equivalent on AWS? How does the AWS "fabric" assign/verify app identities?
- If the only mechanism for verification is an access key and secret key (or a bearer token), I would think that's either a circular problem for credential management or very insecure.
Of course, I could be totally wrong in the way I am comparing Azure identity management to AWS, but it seems that a credential-less verification/assignment of identity as in Azure is probably as secure as it gets.
