# AWS IAM can now authenticate to external services without long-term credentials!

Hi, it's me, Shiichan! I found a nice little authentication update today, so let's dig in.

## What was announced?

AWS's What's New page posted "AWS IAM identity federation to external services is now available in AWS European Sovereign Cloud Region." It announces that AWS Identity and Access Management (IAM) now lets workloads in the AWS European Sovereign Cloud (Germany) Region securely authenticate with external services using short-lived JSON Web Tokens (JWTs).

The AWS European Sovereign Cloud is an independent cloud entirely located within the EU, built to help customers meet their sovereignty requirements.

## The story so far

Up until now, if you wanted AWS workloads to authenticate with external cloud providers, SaaS providers, or self-hosted applications, you had to use long-term credentials or build complex workarounds. Long-term credentials carry real risk if they leak, and they're a pain to manage.

## What changes

With outbound identity federation, you can now exchange your AWS IAM credentials for cryptographically signed, short-lived JWTs. That means you can authenticate securely with third-party cloud providers, SaaS providers, and self-hosted apps without relying on long-term credentials.

These tokens carry rich context about the AWS workload, so external services can implement fine-grained access control on their end.

## Dive Deep

There's solid admin tooling built in:

- Access to token generation can be controlled with IAM policies
- Token properties — lifetime, audience, and signing algorithms — can be enforced via IAM policies
- Token usage can be audited through CloudTrail logs

This makes it easier for organizations to meet their security and compliance requirements. For more details, AWS points to the outbound identity federation product page, the IAM user guide, and an AWS News Blog post.

## Wrap-up

- AWS IAM's outbound identity federation is now available in the AWS European Sovereign Cloud (Germany) Region.
- Workloads can authenticate with external services using short-lived JWTs instead of long-term credentials.
- IAM policies control token issuance and enforce token properties; CloudTrail handles auditing.
- If you need to meet European sovereignty requirements while integrating securely with outside services, this one's worth a look!