JA EN
shiichan

Did You Know Amazon Neptune Can Now Control Access with Just Tags?

AWS What's New ★★★ View Markdown
#aws#security#infrastructure

Hey everyone, it's Shiichan! Today I've got an update that makes access control a lot easier for graph databases.

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, Amazon Neptune Database now supports tag-based access control (TBAC) for IAM. You can use AWS resource tags and IAM principal tags as conditions in IAM policies and Service Control Policies (SCPs) to control access to Neptune data-plane operations.

The story so far

Neptune already had strong security through VPC isolation, TLS encryption, and IAM authentication. But teams managing many clusters at scale wanted a more dynamic, attribute-based way to enforce their organization's access boundaries. Until now, that meant listing out specific cluster ARNs in every single policy.

What changes

With TBAC, admins no longer need to enumerate cluster ARNs in every policy to manage access. For example, a principal tagged Project=FraudDetection can only perform neptune-db:* actions against Neptune clusters that share that same tag. That eliminates lateral access risk within shared VPC environments and makes it easier to enforce team- and environment-level isolation. It also supports federated identity workflows using SAML or OIDC session tags.

Dive Deep

You can combine TBAC with fine-grained permissions like neptune-db:QueryLanguage for even more granular access control.

It requires Neptune engine version 1.2.0.0 or later, with IAM authentication enabled. It's available in every AWS Region where Amazon Neptune is available.

Wrap-up

  • Amazon Neptune now supports tag-based access control (TBAC) for IAM
  • neptune-db:* actions are only allowed when the resource tag matches the principal tag
  • No need to enumerate cluster ARNs individually to manage access boundaries
  • Supports SAML/OIDC session tags and pairs with fine-grained permissions like neptune-db:QueryLanguage
  • Requires Neptune engine 1.2.0.0+ and IAM authentication, available everywhere Neptune is supported

If you're running multiple Neptune clusters and want clean, tag-based access management, this update is for you!

Related posts