AWS IAM vs Keycloak for Application Identity and Access Management

Introduction

As modern applications evolve, the demand for secure, flexible, and centralized identity management becomes more critical. While AWS IAM is the default choice for controlling access to AWS resources, it does not provide full-fledged capabilities for user authentication, SSO, OAuth/OIDC, or identity federation required by application teams.
This is where Keycloak, a powerful open-source identity provider, steps in.

This blog explains why Keycloak is widely used, even within AWS environments, how it compares with AWS IAM, provides real-world use cases, and highlights the key components that make Keycloak a comprehensive authentication solution.

Keycloak Components (Core Building Blocks)

Keycloak provides a rich, modular identity platform. Below are the main components that form its architecture:

1. Realms

A realm is an isolated security domain.

• Each realm has its own users, clients, roles, authentication flows, and configurations.
• Perfect for multi-tenant SaaS applications.

2. Users

End users who authenticate into applications.

• Keycloak stores user credentials, attributes, groups, and permissions.
• Supports external user federation (LDAP, AD).

3. Clients

Applications that use Keycloak for authentication.

• Can be web apps, mobile apps, APIs, or services.
• Integrated using OIDC, OAuth2, or SAML.

4. Roles & Groups

Used for authorization within applications.

• Realm roles: Global roles at realm level.
• Client roles: Roles specific to an application.
• Groups: Organize users and apply role mappings efficiently.

5. Identity Providers (IdPs)

Allows external authentication via:

• Azure AD / Okta
• Google Workspace
• LDAP / Active Directory
• Social logins
  Keycloak becomes a broker between applications and external IdPs.

6. Authentication Flows

Defines the user login experience.
Includes:

• Username/password
• Multi-factor authentication
• Conditional workflows
• Custom authenticators using SPI
  Extremely flexible for enterprise-grade security.

7. Protocol Mappers

Transform or add custom claims inside JWT/OIDC tokens.
Useful when your application needs additional user attributes (email, roles, tenant info).

8. Admin Console

UI for managing realms, clients, roles, policies, and users.

9. Account Console

A self-service interface allowing users to:

• Update profile
• Reset password
• Manage sessions
• Manage MFA

10. Keycloak Storage (Database Layer)

Stores configuration, tokens, and user data.
Often backed by:

• PostgreSQL (most common)
• Amazon RDS / Aurora in AWS deployments

How Keycloak Is Useful Compared to AWS IAM?

In short:

• AWS IAM → Controls access to AWS services
• Keycloak → Handles authentication & SSO for your applications

Specific Use Case: SaaS Application Deployed on Amazon EKS

A multi-tenant SaaS application requires isolated identity domains.

Keycloak Advantages:

• Create one realm per tenant.
• Each realm gets custom branding, MFA, and user sets.
• Integrate each tenant’s corporate IdP (Azure AD / Okta) easily.
• Applications on Amazon EKS validate JWTs from Keycloak.

Why AWS IAM Cannot Be Used:

• AWS IAM users are not meant for application login.
• No support for multi-tenant realms or user self-service.
• No custom SSO flows.

Keycloak becomes the ideal identity hub in AWS.

Conclusion

AWS IAM and Keycloak are complementary, not competing, solutions.
AWS IAM secures AWS infrastructure, while Keycloak secures end-user access to applications.

For modern cloud-native applications, especially SaaS products, Keycloak running on AWS (Amazon EKS, Amazon ECS, or Amazon EC2) delivers unmatched flexibility, federation capabilities, and user management features.

About CloudThat