Identity and access management

Revoking active sessions and short-lived credentials for Workforce Identity Federation users (principals) across all clients is generally available.

You can revoke workforce user sessions by using the gcloud CLI or the REST API.

AWS IAM outbound identity federation now supports interface VPC endpoints for OIDC discovery

AWS Identity and Access Management (IAM) outbound identity federation now supports Amazon Virtual Private Cloud (VPC) endpoints for the OpenID Connect (OIDC) discovery APIs.

You can use System for Cross-domain Identity Management (SCIM) data as the source for both user and group claims in the OAuth sign-in workflows for Looker.

You can also use Extended Session Length (ESL) when using SCIM.

New AWS experience helps builders get started and ship faster

Builders can now sign up for a new simplified experience that makes it faster to turn ideas into running code on AWS. AWS services provide an array of configuration options so that the largest enterprises can customize settings for their distinct needs.

The Cloud OAuth API (cloudoauth.googleapis.com) is available in Preview.

The Cloud OAuth API ( cloudoauth.googleapis.com ) is available in Preview.

AWS STS simplifies session token size limits and adds session token size monitoring

AWS Security Token Service (STS) now enforces a single 4,096-byte size limit on session tokens. Previously, STS enforced separate limits on session token size and passed-in parameters (i.e., inline policies, managed policies, and session tags).

Policy Troubleshooter now supports troubleshooting access for agent identities.

You can troubleshoot IAM allow policies, deny policies, and principal access boundary policies for agents acting under their own authority by entering the agent's principal identifier or by troubleshooting with an error ID from an access denial event.

AWS improves regional resiliency for root user sign-in

AWS root user sign-in is now served across US East (N. Virginia), US East (Ohio), and US West (Oregon), with sign-in traffic distributed across all three Regions. This change reduces reliance on US East (N. Virginia) and improves resiliency during service disruptions.

The Identity and Access Management (IAM) Model Context Protocol (MCP) server is generally available.

You can connect to the IAM remote MCP server from AI applications to inspect and manage custom roles and deny policies across your resources.

The Policy Assist REST API is available in Preview.

Policy Assist lets you get IAM role suggestions for individual principals with AI assistance.

The Policy Assist remote MCP server is available in Preview.

To learn about using the Policy Assist remote MCP server to let external AI agents and applications suggest IAM roles, see Use the Policy Assist remote MCP server and the Policy Assist MCP reference.

You can get IAM role suggestions from Gemini programmatically by using the Policy Assist API (Preview).

You can get IAM role suggestions from Gemini programmatically by using the Policy Assist API ( Preview ).

The Policy Analyzer MCP server is generally available.

To learn about using the Policy Analyzer MCP server to let agents and AI applications analyze and audit IAM configurations, see Use the Policy Analyzer remote MCP server.

IAM Roles Anywhere now provides a Java plugin for the AWS SDK

AWS Identity and Access Management (IAM) Roles Anywhere now provides a plugin for the AWS SDK for Java v2 that enables workloads running outside of AWS to obtain temporary AWS credentials directly within the Java application process.

The Agent Identity auth manager and the Agent Identity APIs (agentidentity.googleapis.com and agentidentitycredentials.googleapis.com) are generally available.

The Agent Identity auth manager and the Agent Identity APIs ( agentidentity.googleapis.com and agentidentitycredentials.googleapis.com ) are generally available.

AWS Partner Central agents MCP Server now supports OAuth with AWS Sign-In

AWS partners can now access AWS Partner Central agents from tools they already use, such as Amazon Quick and Kiro, using OAuth through AWS Sign-In.

AWS IAM now supports 20 managed policies per role by default

AWS Identity and Access Management (IAM) has increased the default quota for managed policies per role from 10 to 20.

IAM Policy Autopilot now supports Terraform plan files

IAM Policy Autopilot can now generate baseline IAM policies directly from a Terraform plan file.

AWS IAM identity federation to external services is now available in AWS European Sovereign Cloud Region

AWS Identity and Access Management (IAM) now enables AWS workloads in the AWS European Sovereign Cloud (Germany) Region to securely authenticate with external services using short-lived JSON Web Tokens (JWTs).

AWS IAM now provides role manager to set up IAM roles automatically

Today, AWS announces the general availability of role manager, a capability in AWS Identity and Access Management (IAM) that automatically sets up the IAM roles your AWS services need.