Amazon Web Services → Microsoft Azure
Azure equivalent of IAM Roles Anywhere
IAM Roles Anywhere (X.509 certificates) and IAM OIDC identity providers map to Microsoft Entra workload identity federation, which trusts OIDC tokens from external issuers such as GitHub Actions, Kubernetes, Google, or AWS.
About IAM Roles Anywhere
| Provider | Amazon Web Services |
|---|---|
| Status | Generally available |
| What it is | Lets workloads outside AWS get temporary AWS credentials by presenting X.509 certificates from a CA you register as a trust anchor. |
| Documentation | docs.aws.amazon.com |
| Pricing | Official pricing page |
Azure mappings (1)
| Capability | Azure equivalent | Match |
|---|---|---|
| Federation for workloads outside the cloud | Microsoft Entra workload identity federation | Partial match |
Identity & access management(1)
Federation for workloads outside the cloud Partial match
IAM Roles Anywhere (X.509 certificates) and IAM OIDC identity providers map to Microsoft Entra workload identity federation, which trusts OIDC tokens from external issuers such as GitHub Actions, Kubernetes, Google, or AWS.
- Trust type. Roles Anywhere trusts certificates from a CA you register. Entra workload identity federation trusts OIDC tokens. For certificate-based workloads on Azure, use app registrations with certificate credentials, or Azure Arc-enabled servers with managed identities for on-premises machines.
- Cross-cloud. To call Azure from AWS, Microsoft documents exchanging an AWS-issued OIDC token (for example, through Cognito) for an Entra token. To call AWS from Azure, configure Entra ID as an IAM OIDC provider.