Microsoft Azure → Amazon Web Services
AWS equivalent of Microsoft Entra workload identity federation
The closest AWS equivalents of Microsoft Entra workload identity federation are IAM Roles Anywhere and AWS Identity and Access Management (IAM).
About Microsoft Entra workload identity federation
| Provider | Microsoft Azure |
|---|---|
| Status | Generally available |
| What it is | Lets an app registration or user-assigned managed identity trust tokens from external IdPs (GitHub Actions, Kubernetes, Google, AWS, other OIDC issuers) instead of using secrets. |
| Documentation | learn.microsoft.com |
| Pricing | Official pricing page |
AWS mappings (1)
| Capability | AWS equivalent | Match |
|---|---|---|
| Federation for workloads outside the cloud | IAM Roles Anywhere, AWS Identity and Access Management (IAM) | Partial match |
Identity & access management(1)
Federation for workloads outside the cloud Partial match
IAM Roles Anywhere (X.509 certificates) and IAM OIDC identity providers map to Microsoft Entra workload identity federation, which trusts OIDC tokens from external issuers such as GitHub Actions, Kubernetes, Google, or AWS.
- Trust type. Roles Anywhere trusts certificates from a CA you register. Entra workload identity federation trusts OIDC tokens. For certificate-based workloads on Azure, use app registrations with certificate credentials, or Azure Arc-enabled servers with managed identities for on-premises machines.
- Cross-cloud. To call Azure from AWS, Microsoft documents exchanging an AWS-issued OIDC token (for example, through Cognito) for an Entra token. To call AWS from Azure, configure Entra ID as an IAM OIDC provider.