IAM Identity Center now supports multi-Region replication even with its own built-in directory!

Hey there, it's Shii! Today I found an update around AWS IAM that might look subtle at first, but it's great news if your team cares about availability. Let me share it with you!

AWS What's New aws.amazon.com

What was announced?

This comes from AWS What's New: IAM Identity Center's multi-Region support now extends to organizations that use Identity Center's own built-in directory as their identity source. IAM Identity Center is the service that gives your workforce single sign-on access to AWS accounts and applications. With this update, you can now replicate identity data from the primary Region where you first enabled it to additional Regions of your choice.

The story so far

Until now, multi-Region support was only available for Identity Center organization instances connected to an external identity provider, like Okta or Azure AD. Organizations using Identity Center's own directory as the identity source couldn't get that benefit, which meant the primary Region effectively stayed a single point of failure.

What changes

Once you turn this on, IAM Identity Center automatically replicates identities, entitlements, and other information from the primary Region to your additional Regions. If the primary Region runs into trouble, users can keep accessing their AWS accounts using the entitlements already provisioned in the additional Regions.

Application administrators can keep deploying to the additional Region through their normal workflow, while Identity Center itself is still administered from the primary Region, so you don't need to rethink how you operate day to day. Being able to pick Regions based on data residency or proximity to your users is also a quietly big win.

Dive Deep

To enable this, your organization instance needs a multi-Region customer managed KMS key (CMK) configured, the same mechanism used for the existing external-IdP multi-Region support. It's currently available in the 17 enabled-by-default commercial AWS Regions.

On pricing, IAM Identity Center itself doesn't add any cost, you just pay the standard AWS KMS charges for storing and using the CMK. Not every AWS application supports deployment to an additional Region yet, so it's worth checking the compatibility list before you rely on it.

Wrap-up

• Organizations using Identity Center's own directory can now use multi-Region replication too
• If the primary Region has an outage, users keep access via entitlements already provisioned in the additional Region
• Enabling it requires a multi-Region CMK, and the only added cost is standard KMS pricing

This is a nice update for AWS admins running multi-Region organizations, or any team that cares about availability and data residency!