Assigning policies for accessing multiple computing resource services

A computer implemented method, comprising:

• by a first computing resource service provider system comprising a plurality of computing devices, the first computing resource service provider system hosting a directory service that comprises a policy mapping database that maps policies to users, the policies specifying access rights of users to applications, including applications not hosted by the first computing resource service provider system:
• receiving a request from a user device to access an application hosted by a second computing resource service provider system that is separate from the first computing resource service provider system, wherein the directory service manages user access to the application;
• authenticating user credentials received from the user device, the user credentials associated with a user;
• identifying, based on the policy mapping database, one or more policies applicable to the user, wherein the identified one or more policies specify which applications, of a plurality of applications managed by the directory service, the user is authorized to access;
• determine, based on the one or more policies, that the user device is authorized to initiate execution of the application;
• and
• request temporary credentials from the second computing resource service provider system, wherein the temporary credentials enable the user device to initiate execution of the application.

Non-transitory computer storage that comprises executable program instructions that direct one or more computing devices of a first computing resource service provider system to implement a process that comprises:

• implementing a directory service that comprises a directory that manages access to applications, including an application that is hosted on a second computing resource service provider system external to the first computing resource service provider system;
• maintaining a policy mapping database that maps policies to users, the policies specifying access rights of users to the applications;
• receiving a request from a user device to access the application;
• authenticating user credentials received from the user device, the user credentials associated with a user;
• identifying, based on the policy mapping database, one or more policies applicable to the user, wherein the identified one or more policies specify which applications managed by the directory service the user is authorized to access;
• and
• determining, based on the one or more policies, that the user is authorized to initiate execution of the application;
• and
• obtain temporary credentials from the second computing resource service provider system, wherein the temporary credentials enable the user device to initiate execution of the application.