AWS Security Token Service (STS) now supports Internet Protocol version 6 (IPv6) addresses via new dual-stack endpoints. You can connect to STS over the public internet using IPv6, IPv4, or dual-stack (both IPv4 and IPv6) clients. Dual-stack support is also available when you access STS endpoints privately from your Amazon Virtual Private Cloud (VPC) using AWS PrivateLink, allowing you to invoke STS APIs without traversing the public internet. Support for dual-stack STS endpoints is available in all AWS Commercial Regions, AWS GovCloud (US) Regions, and China Regions. To get started, configure your STS client to use the new dual-stack endpoints using the configuration instructions in the https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_dual-stack_endpoint_support.html.

AWS Identity and Access Management (IAM) now enables AWS workloads in the AWS European Sovereign Cloud (Germany) Region to securely authenticate with external services using short-lived JSON Web Tokens (JWTs). The AWS European Sovereign Cloud is an independent cloud for Europe entirely located within the European Union (EU), designed to help customers meet their evolving sovereignty requirements. With outbound identity federation, AWS workloads can securely authenticate with third-party cloud providers, SaaS providers, and self-hosted applications without using long-term credentials or implementing complex workarounds. Customers can exchange their AWS IAM credentials for cryptographically signed, short-lived JWTs, providing a simple and secure mechanism to access external services. These tokens contain rich context about the AWS workloads, enabling external services to implement fine-grained access control. Administrators can control access to token generation and enforce token properties (such as lifetime, audience, and signing algorithms) using IAM policies and audit token usage using CloudTrail logs, allowing them to meet their organization's security and compliance requirements. To learn more, visit the outbound identity federation product page, see the IAM user guide, or read the AWS News Blog Post.

AWS Identity and Access Management (IAM) now enables AWS workloads in the AWS European Sovereign Cloud (Germany) Region to securely authenticate with external services using short-lived JSON Web Tokens (JWTs). The AWS European Sovereign Cloud is an independent cloud for Europe entirely located within the European Union (EU), designed to help customers meet their evolving sovereignty requirements. With outbound identity federation, AWS workloads can securely authenticate with third-party cloud providers, SaaS providers, and self-hosted applications without using long-term credentials or implementing complex workarounds. Customers can exchange their AWS IAM credentials for cryptographically signed, short-lived JWTs, providing a simple and secure mechanism to access external services. These tokens contain rich context about the AWS workloads, enabling external services to implement fine-grained access control. Administrators can control access to token generation and enforce token properties (such as lifetime, audience, and signing algorithms) using IAM policies and audit token usage using CloudTrail logs, allowing them to meet their organization's security and compliance requirements. To learn more, visit the https://aws.amazon.com/identity/federation/outbound-federation/, see the https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound.html, or read the https://aws.amazon.com/blogs/aws/simplify-access-to-external-services-using-aws-iam-outbound-identity-federation/.

AWS Security Token Service (AWS STS) now automatically serves all requests to the global endpoint (sts.amazonaws.com) in the same AWS Region as your deployed workloads, enhancing resiliency and performance. Previously, all requests to the STS global endpoint were served from the US East (N. Virginia) Region. With this enhancement, your applications benefit from improved latency and fault isolation as requests are processed in the same Region as your workloads. For example, if your application runs in US West (Oregon) and calls the STS global endpoint, your requests are now served locally in US West (Oregon) instead of being routed to US East (N. Virginia). This update is available in all AWS Regions that are enabled by default. No action is required from customers to benefit from these improvements. Any requests to the STS global endpoint from Regions not enabled by default (i.e. opt-in Regions) will continue to be served in US East (N. Virginia). We continue to recommend that you use the appropriate https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html whenever possible. For more information about these changes, see https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_region-endpoints.html#reference_sts_global_endpoint_changes , and the https://aws.amazon.com/blogs/security/announcing-upcoming-changes-to-the-aws-security-token-service-global-endpoint/  

AWS Security Token Service (AWS STS) now automatically serves all requests to the global endpoint (sts.amazonaws.com) in the same AWS Region as your deployed workloads, enhancing resiliency and performance. Previously, all requests to the STS global endpoint were served from the US East (N. Virginia) Region. With this enhancement, your applications benefit from improved latency and fault isolation as requests are processed in the same Region as your workloads. For example, if your application runs in US West (Oregon) and calls the STS global endpoint, your requests are now served locally in US West (Oregon) instead of being routed to US East (N. Virginia). This update is available in all AWS Regions that are enabled by default. No action is required from customers to benefit from these improvements. Any requests to the STS global endpoint from Regions not enabled by default (i.e. opt-in Regions) will continue to be served in US East (N. Virginia). We continue to recommend that you use the appropriate STS Regional endpoints whenever possible. For more information about these changes, see AWS STS global endpoint changes , and the announcement blogpost.