Discover more about what's new at AWS with Centrally manage root access in AWS Identity and Access Management (IAM)

Discover more about what's new at AWS with Centrally manage root access in AWS Identity and Access Management (IAM)

Today, AWS announced cross-account and cross-role access for the AWS Model Context Protocol (MCP) Server, part of the https://aws.amazon.com/products/developer-tools/agent-toolkit-for-aws/. This feature allows developers using AI coding agents like Kiro, Claude Code, or Codex to work across multiple AWS accounts and AWS Identity and Access Management (IAM) roles within a single session, with no restarts required. Previously, switching profiles required stopping the AI coding session, updating local AWS credentials, and restarting the MCP server for every account change. Now, AI agents using the AWS MCP Server can specify a profile on each command, allowing users to switch between accounts and roles seamlessly. Cross-account access helps developers move faster across multi-account environments. For example, a DevOps engineer can query CloudWatch logs across production and staging accounts to diagnose a performance issue, or an application developer can update a Lambda configuration in one account and adjust an S3 bucket policy in another, all within the same conversation. Each request specifies which profile to use, so there is no risk of commands reaching the wrong account. To get started, see https://docs.aws.amazon.com/agent-toolkit/latest/userguide/multi-account-access.html in the Agent Toolkit for AWS user guide. The AWS MCP Server is available in the US East (N. Virginia) and Europe (Frankfurt) Regions.

AWS Identity and Access Management (IAM) is a security service used to control access to AWS resources. It allows organizations to create and manage users, groups, roles, and permissions. IAM follows the principle of least privilege by granting only the permissions required for a task. It supports secure authentication and authorization for AWS services and applications. IAM is a foundational AWS service for managing cloud security and access control.

When I started learning AWS, I quickly realized that creating resources was only part of the challenge. Another important question is: "Who is allowed to access them?"

Keycloak is an identity and access management platform that provides authentication, authorization, single sign-on, identity federation, and OpenID Connect support. This article explains how to run Keycloak on Amazon EKS with Amazon RDS for PostgreSQL and integrate it with applications and APIs through a cloud-native architecture.

AWS Identity and Access Management (IAM) helps control who can access AWS resources and what actions they are allowed to perform. Understanding IAM is an important first step for students learning cloud security and AWS.

For recognized shared OIDC providers, IAM requires explicit evaluation of specific claims in role trust policies to validate that only authorized federated identities can assume roles.

A reflection on my Week 2 learning journey in AWS Cloud Security Foundations, focusing on secure access management and cloud resource protection.

Security incident triage usually starts cold. An Amazon CloudWatch alarm fires at 2 a.m. because an AWS Identity and Access Management (IAM) access key just created another access key. The responder spends the first 30 minutes assembling evidence from AWS CloudTrail, Amazon CloudWatch Logs, and Amazon Virtual Private Cloud (Amazon VPC) Flow Logs before deciding [...]

A beginner-friendly guide to AWS Identity and Access Management (IAM), covering users, groups, roles, policies, permissions, and security best practices for students learning AWS Cloud.

It's pre:Invent season, and one of the most consequential identity and access management features was just released by the identity team at AWS. Resource Control Policies, a strong tool for establishi...

IAM JSON ポリシー言語の Action 要素を記述します。

A targeted campaign exploited Server-Side Request Forgery (SSRF) vulnerabilities in websites hosted on AWS EC2 instances to extract EC2 Metadata, which could include Identity and Access Management (IAM) credentials from the IMDSv1 endpoint.

Get started with AWS Identity and Access Management (IAM) on LocalStack

Comprehensive open source identity management solution offering single sign-on, social login, and fine-grained authorization for applications and services.

AWS Identity and Access Management (IAM) outbound identity federation now supports Amazon Virtual Private Cloud (VPC) endpoints for the OpenID Connect (OIDC) discovery APIs. You can now access the OIDC discovery metadata and JSON Web Key Set (JWKS) verification key endpoints from within your VPC using AWS PrivateLink, without requiring traffic to traverse the public internet. IAM outbound identity federation eliminates the need to use long-lived credentials when your AWS workloads access external services. Instead, your workloads request short-lived JSON Web Tokens (JWTs) from AWS Security Token Service (AWS STS). External services verify these tokens using public verification keys and metadata available at OIDC discovery endpoints. Previously, the OIDC discovery endpoints were only reachable over the public internet, so a verifying workload running in a VPC without internet access could not retrieve them. With this launch, you can create an interface VPC endpoint to reach these endpoints privately, keeping the verification key retrieval traffic within the AWS network. This capability helps you meet network security requirements for workloads that operate in VPCs with restricted internet access, while still enabling external services to verify JWTs. This feature is available in all commercial AWS Regions, the AWS GovCloud (US) Regions, and China Regions. There is no additional charge for this feature beyond standard AWS PrivateLink pricing. To learn more, see the IAM User Guide.

AWS Identity and Access Management (IAM) outbound identity federation now supports Amazon Virtual Private Cloud (VPC) endpoints for the OpenID Connect (OIDC) discovery APIs. You can now access the OIDC discovery metadata and JSON Web Key Set (JWKS) verification key endpoints from within your VPC using AWS PrivateLink, without requiring traffic to traverse the public internet. IAM outbound identity federation eliminates the need to use long-lived credentials when your AWS workloads access external services. Instead, your workloads request short-lived JSON Web Tokens (JWTs) from AWS Security Token Service (AWS STS). External services verify these tokens using public verification keys and metadata available at OIDC discovery endpoints. Previously, the OIDC discovery endpoints were only reachable over the public internet, so a verifying workload running in a VPC without internet access could not retrieve them. With this launch, you can create an interface VPC endpoint to reach these endpoints privately, keeping the verification key retrieval traffic within the AWS network. This capability helps you meet network security requirements for workloads that operate in VPCs with restricted internet access, while still enabling external services to verify JWTs. This feature is available in all commercial AWS Regions, the AWS GovCloud (US) Regions, and China Regions. There is no additional charge for this feature beyond standard AWS PrivateLink pricing. To learn more, see the IAM User Guide.

IAM Identity Center now supports customer-managed AWS Key Management Service (KMS) keys for encrypting workforce identity data, including user and group attributes. While AWS-owned keys are used by default, customer-managed keys (CMKs) provide granular control over identity data access, enhancing security and compliance capabilities. IAM Identity Center helps you securely create, or connect, your workforce identities and manage their access centrally across AWS applications and accounts. You create a CMK and manage its lifecycle and usage permissions in AWS KMS. You can configure the CMK in your IAM Identity Center instance either while enabling a new organization instance or on an existing one. You can then use AWS CloudTrail to monitor and audit the usage of your CMK for access to identity data in IAM Identity Center. Support for CMKs in organization instances of IAM Identity Center is now available for access to accounts and https://docs.aws.amazon.com/singlesignon/latest/userguide/awsapps-that-work-with-identity-center.html in all https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/ where IAM Identity Center is available. Standard AWS KMS https://aws.amazon.com/kms/pricing/ apply to storing and using CMKs. IAM Identity Center is provided at no additional cost. To learn more about IAM Identity Center, visit the https://aws.amazon.com/iam/identity-center/. To get started with using CMKs, please refer to the IAM Identity Center https://docs.aws.amazon.com/singlesignon/latest/userguide/encryption-at-rest.html.

As I move ahead on my AWS learning path ,I have done some hands -on work AWS identity and Access Management. I have discovered that what is AWS and uses of AWS . In this post .I would like to discuss my understanding of concepts. I am moving ahead on my learning path in the field of AWS, Linux, networking and DevOps fundamentals