JA EN
shiichan

IAM Identity Center Adds Network Access Controls for Identity Store!

AWS What's New ★★★★ View Markdown
#aws#security

Hi, it's Shii-chan! Today's news is a new feature that protects user data in IAM Identity Center!

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, IAM Identity Center now supports network access controls for Identity Store, which stores your users and groups. You can restrict access to the Identity Store API and the SCIM API based on the network that requests originate from.

Why it matters

These two APIs sit at the center of your user data.

  • Identity Store API: custom applications and user provisioning workflows use it to manage and look up users and groups
  • SCIM API: your external identity provider uses it to synchronize users and groups

Being able to narrow the paths into them is a real confidence boost!

What changes

You can apply different restrictions to each API.

  • Identity Store API: require that requests arrive only through allowed VPC endpoints in your account or organization, or from specific source VPCs
  • Both APIs: allow requests only from specific IP ranges

For example, you can require that Identity Store API requests arrive only through VPC endpoints, while allowing SCIM requests from your external identity provider's published IP ranges.

Dive Deep

  • Network access controls are optional and turned off by default
  • Requests that AWS services make on your behalf are exempt
  • You configure them with the Identity Store API through the AWS SDKs and AWS CLI
  • Available in all AWS Regions where IAM Identity Center is offered

Wrap-up

  • Restrict Identity Store API and SCIM API access by network
  • Use VPC endpoints, source VPCs, or IP ranges, with different settings per API
  • Off by default, and AWS service requests on your behalf are exempt

This is for security teams who want to lock down access paths to their identity foundation!

Related posts