Which API call is used to request temporary security credentials from AWS when federating with Active Directory?

The correct call for requesting temporary security credentials when federating with Active Directory is the AssumeRoleWithSAML API call. This API is specifically designed to support SAML (Security Assertion Markup Language) assertions, which are often used in enterprise environments where users authenticate against Active Directory.

When a user logs in through a SAML-based identity provider (IdP), the IdP provides a SAML assertion that can be used in conjunction with AssumeRoleWithSAML. This assertion contains information about the user and can be used to obtain temporary AWS credentials that grant access to specific AWS resources for a limited time. This is particularly useful in scenarios where organizations want to maintain existing identity systems while securely granting permissions to AWS resources.

Understanding the use case for AssumeRoleWithSAML is critical for integrating AWS into existing enterprise workflows, especially in environments using Microsoft Active Directory. The temporary credentials obtained via this method enable seamless access control aligned with existing identity and security policies within the organization.