# Optimistic Locking Arrives in IAM Identity Center: No More Silent Overwrites!

Hi everyone, it's Shii-chan! Today's IAM Identity Center update is a nice one for automation.

## What was announced?

In AWS What's New, IAM Identity Center announced optimistic locking for users and groups in its identity store.

Update and delete requests now succeed only if the user or group hasn't changed since you last read it.

## The story so far

When multiple administrators or automated workflows modified the same user or group at nearly the same time, one write could silently overwrite another.

## What changes

Each user and group now has a Revision value. It changes every time the attributes are modified, including through SCIM provisioning, Active Directory sync, or the console.

- Create, describe, update, and list operations return the current Revision
- You can pass it on UpdateUser, UpdateGroup, DeleteUser, or DeleteGroup requests
- The request succeeds only if the supplied Revision matches the current one
- Otherwise it returns a ConflictException, so your workflow can re-read and retry with the latest values

## Dive Deep

A few things to keep in mind:

- Providing a Revision is optional. Requests that omit it behave as before, so existing integrations keep working
- Conditional requests are supported through the Identity Store API, not the SCIM endpoint
- Group membership operations don't accept a Revision
- Adding or removing members doesn't change the Revision of the user or the group
- Available in all AWS Regions where IAM Identity Center is available

## Wrap-up

- Users and groups get a Revision and support optimistic locking
- A mismatch returns a ConflictException, preventing silent overwrites
- Revision is optional, so existing integrations don't break
- The SCIM endpoint and group membership operations are out of scope

This is for admins writing automation against the Identity Store API!