IAM Identity Center trusted identity propagation now works across Regions!
Hello, Shii-chan here! Today's news is about AWS access management, and it is good news for multi-Region setups!
AWS What's New
aws.amazon.com
What was announced?
According to AWS What's New, AWS IAM Identity Center now supports cross-Region trusted identity propagation.
Trusted identity propagation carries a user's identity with their request. AWS services can then grant permissions based on who the user is and their group associations, and log that user's access for auditing.
The story so far
Previously, all of the AWS services accessing a user's identity had to be in the same Region. To reach services in another Region, you had to either:
- Grant access through broad IAM roles that cannot distinguish individual users
- Consolidate all your services into a single Region
What changes
A user's identity now travels with the request across Regions automatically.
- You can grant access based on the user and their groups
- You can audit who accessed which resources
- You keep fine-grained access control for every individual user
The announcement lists reasons to spread workloads across Regions:
- Separating compute from the data it queries
- Running workloads where capacity is available
- Disaster recovery
- Global scale
Dive Deep
Here is what the announcement tells us:
- No additional cost
- Available in all Regions where IAM Identity Center is available
- For setup details, see the trusted identity propagation overview in the IAM Identity Center User Guide
Wrap-up
- Trusted identity propagation now works across Regions
- Before, you needed broad IAM roles or a single Region
- Per-user and per-group permissions and auditing now continue across Regions
- No additional cost, in all Regions where IAM Identity Center is available
This is for anyone running multi-Region analytics or data platforms who wants per-user permissions!
