JA EN
shiichan

IAM Roles Anywhere Gets a Dedicated Java Plugin!

AWS What's New ★★★★ View Markdown
#aws#security#devops

Hey, Shiichan here! Today's update is a quiet but genuinely useful one on the authentication side.

AWS What's New aws.amazon.com

What was announced?

This comes from AWS What's New. AWS IAM Roles Anywhere now ships a plugin for the AWS SDK for Java v2. IAM Roles Anywhere issues temporary AWS credentials to workloads running outside of AWS, and this new plugin lets you obtain those credentials directly within your Java application's own process.

The story so far

Until now, using IAM Roles Anywhere meant running a separate credential-helper process, or configuring credential_process in your AWS profile. Either way, you needed an extra process sitting outside your main application, which made the setup a bit of a hassle.

What changes

The new plugin runs inside the same JVM as your application, so you no longer need a separate process or a credential_process configuration. Just configure the plugin on your AWS SDK for Java v2 service client builder, and it automatically resolves temporary credentials — no need to write your own credential-fetching logic. It also handles calling CreateSession and automatically refreshes credentials before they expire, taking that off your plate entirely.

Dive Deep

The plugin supports three key types: RSA, Elliptic Curve (EC), and ML-DSA. ML-DSA is a post-quantum signature scheme, so this also covers forward-looking key management. It requires Java 8 or higher, and there's no additional charge for using the plugin.

Region coverage is broad too — it's available in all AWS Regions, plus AWS GovCloud (US), the AWS European Sovereign Cloud (Germany) Region, and China Regions. Full documentation lives on the IAM Roles Anywhere Java plugin page, with version info and signature-verification steps on the plugin's Maven Central page and the roles-anywhere-java GitHub repository.

Wrap-up

  • IAM Roles Anywhere now offers a plugin for the AWS SDK for Java v2
  • No more separate credential-helper process or credential_process config — credentials resolve inside the same JVM
  • The plugin handles CreateSession calls and refreshes credentials automatically before they expire
  • Supports RSA, EC, and ML-DSA keys, requires Java 8+, and costs nothing extra

If you're running Java workloads outside of AWS and want to simplify how you manage credentials, this update is worth a look!

Related posts