AWS Identity and Access Management

AWS IAM outbound identity federation now supports interface VPC endpoints for OIDC discovery

AWS Identity and Access Management (IAM) outbound identity federation now supports Amazon Virtual Private Cloud (VPC) endpoints for the OpenID Connect (OIDC) discovery APIs.

New AWS experience helps builders get started and ship faster

Builders can now sign up for a new simplified experience that makes it faster to turn ideas into running code on AWS. AWS services provide an array of configuration options so that the largest enterprises can customize settings for their distinct needs.

AWS STS simplifies session token size limits and adds session token size monitoring

AWS Security Token Service (STS) now enforces a single 4,096-byte size limit on session tokens. Previously, STS enforced separate limits on session token size and passed-in parameters (i.e., inline policies, managed policies, and session tags).

AWS improves regional resiliency for root user sign-in

AWS root user sign-in is now served across US East (N. Virginia), US East (Ohio), and US West (Oregon), with sign-in traffic distributed across all three Regions. This change reduces reliance on US East (N. Virginia) and improves resiliency during service disruptions.

IAM Roles Anywhere now provides a Java plugin for the AWS SDK

AWS Identity and Access Management (IAM) Roles Anywhere now provides a plugin for the AWS SDK for Java v2 that enables workloads running outside of AWS to obtain temporary AWS credentials directly within the Java application process.

AWS Partner Central agents MCP Server now supports OAuth with AWS Sign-In

AWS partners can now access AWS Partner Central agents from tools they already use, such as Amazon Quick and Kiro, using OAuth through AWS Sign-In.

AWS IAM now supports 20 managed policies per role by default

AWS Identity and Access Management (IAM) has increased the default quota for managed policies per role from 10 to 20.

IAM Policy Autopilot now supports Terraform plan files

IAM Policy Autopilot can now generate baseline IAM policies directly from a Terraform plan file.

AWS IAM identity federation to external services is now available in AWS European Sovereign Cloud Region

AWS Identity and Access Management (IAM) now enables AWS workloads in the AWS European Sovereign Cloud (Germany) Region to securely authenticate with external services using short-lived JSON Web Tokens (JWTs).

AWS IAM now provides role manager to set up IAM roles automatically

Today, AWS announces the general availability of role manager, a capability in AWS Identity and Access Management (IAM) that automatically sets up the IAM roles your AWS services need.

AWS Identity and Access Management streamlines assignment of IAM roles to workforce users with account access manager

AWS Identity and Access Management (IAM) launched account access manager, a feature that streamlines assignment of IAM roles to workforce users.

IAM Policy Simulator moves to the IAM console and adds additional capabilities

AWS Identity and Access Management (IAM) announces a major update to IAM Policy Simulator, the tool you use to test and validate the permissions your IAM policies grant before you deploy them.

OAuth support for the AWS MCP Server

You can now connect AI agents directly to the AWS MCP Server using AWS Sign-In. Agents connect using industry-standard OAuth without requiring additional authentication software.

AWS Sign-in now supports resource-based policies and resource control policies

(RCPs) for the AWS Management Console. You can use these policies to restrict console sign-in to expected networks. Policies are evaluated during sign-in and whenever the console session requests new credentials.

AWS Organizations now supports higher quotas for service control policies (SCPs)

. The maximum number of SCPs that can be attached to a single node (root, OU, or account) has increased from 5 to 10, and the maximum SCP size has increased from 5,120 to 10,240 characters.

IAM Policy Autopilot adds Java support and Terraform-aware policy generation

IAM Policy Autopilot now supports Java applications and Terraform-aware policy generation, expanding its language coverage and its ability to generate less permissive IAM policies from code.

AWS IAM now provides higher maximum quotas for roles, role trust policies, instance profiles, managed policies, and identity providers

AWS Identity and Access Management (IAM) has increased maximum quotas for six resources:

IAM Roles Anywhere now enforces VPC endpoint policies for the CreateSession API

AWS Identity and Access Management (IAM) Roles Anywhere now provides the capability to configure Virtual Private Cloud (VPC) endpoint policies for the IAM Roles Anywhere CreateSession API. You can update your VPC endpoint policies to allow or deny the CreateSession operation.

IAM Roles Anywhere now supports post-quantum digital certificates

AWS Identity and Access Management (IAM) Roles Anywhere now supports the FIPS 204 Module-Lattice Digital Signature Standard (ML-DSA), a quantum-resistant digital signature algorithm standardized by the National Institute of Standards and Technology (NIST) to help protect against…

AWS simplifies IAM role creation and setup in service workflows

AWS Identity and Access Management (IAM) now makes it easier to create and configure IAM roles directly within service workflows, allowing you to customize role permissions without switching between browser tabs.