All news with #iam tag

🔐 AWS Sign-In now supports OAuth for connecting agents to the AWS MCP Server, enabling browser-based and headless authentication that leverages existing IAM, IAM Identity Center, and federated sign-in methods. The update includes dynamic client registration, token introspection and revocation, new CloudTrail elements, global condition keys, and a headless OAuth API. Agents discover OAuth endpoints, register via DCR, and use authorization code or client credentials flows to obtain short-lived tokens. Administrators can govern OAuth access using standard IAM policies plus OAuth-specific condition keys and monitor activity via CloudTrail.

🔒 This article examines the risks of agentic AI and non-human identities in enterprise environments, illustrating incidents where LLM-based agents caused outages due to weak identity controls. It argues that existing IAM models are insufficient for agents that act autonomously, and cites industry guidance from Gartner, OWASP, CISA and NIST. The author proposes six minimum requirements and a cumulative six-stage NHI maturity model to ensure defensible production deployments.

🔍 Today, AWS Security Hub introduces impact analysis for exposure findings, enabling security teams to see the downstream resources an attacker could reach if an exposure is exploited. The feature maps privilege escalation paths by analyzing effective IAM permissions and displays potential attack paths in a graph. A new Impact Assessment tab prioritizes chains of compromise and shows the permissions at each step, while severity scores are adjusted to reflect downstream reach.

🛡️ Existing security controls weren’t built for autonomous AI agents, and static credentials and standing privileges are insufficient. Organizations must define agentic identity, secure agent-to-agent communication, adopt dynamic secrets management, enforce least privilege for delegated workflows, and unify workforce identity. Governance across the identity lifecycle is essential to ensure auditable, revocable, and context-aware access for agents.

🔒 This post by Raji Dani, Microsoft Deputy CISO, explains how Microsoft secures its partner ecosystem—especially Microsoft Cloud Solution Providers (CSPs)—to reduce risk to downstream customers. It outlines vetting, mandatory security requirements for authorization, granular delegated administrative privileges (GDAP), telemetry and rapid access revocation capabilities. The article emphasizes shared responsibility between Microsoft and partners and a continual roadmap to raise security standards.

🔒 This article explains how traditional identity lifecycle management — built around HR-driven joiner, mover, and leaver events — fails to govern AI agents. It describes how agents are created outside HR and IGA workflows, arrive with embedded credentials, and expand access dynamically at runtime. The piece highlights gaps in provisioning, access reviews, and offboarding when agents proliferate across parallel instances and orchestration layers.

🔒 This post explains how to use two enhancements to the AWS Workload Credentials Provider: role chaining for cross-account secret retrieval and prefetching to reduce cold-start latency. It covers configuration, required IAM permissions, SSRF token usage, and how to build and deploy the Rust-based provider across EC2, ECS, EKS, and Lambda. Examples show curl and Python calls, TOML configuration for max roles, and prefetch settings for individual secrets or tag-based discovery.

🔒 Amazon RDS for Db2 now lets customers join DB instances directly to self-managed Microsoft Active Directory domains, whether on-premises, in AWS, or in another cloud. Using Kerberos for authentication, this enables single sign-on and allows customers to authenticate and authorize database users without deploying AWS Managed Microsoft AD or creating a domain trust. Domain join is available when creating or modifying instances using a delegated AD service account stored in AWS Secrets Manager and encrypted with AWS KMS, and the feature is generally available in all Regions where RDS for Db2 is offered, including GovCloud.

🔒 Amazon Connect Customer now permits assigning up to seven security profiles per user, up from two, enabling granular, scoped permissions for agents who support multiple lines of business. This supports tag-based or hierarchy-based access controls so each profile can grant access only to resources for a specific division. The change improves flexibility to implement least-privilege access aligned with organizational structure and is available in all AWS regions where Amazon Connect is offered.

🛡️ This guide examines how agentic AI shifted enterprise identity risks and why existing IAM controls fall short. It explains how AI agents inherit human permissions, traverse systems at machine speed, and create an expanding population of autonomous identities often deployed without security review. The piece outlines the guardian agent concept: a purpose-built runtime control layer that inventories agents, baselines behavior, detects anomalies, and enforces least-privilege at execution time to close the governance gap.

🔐 AWS Sign-in now supports resource-based policies and resource control policies (RCPs) for the AWS Management Console. These policies let administrators restrict console sign-in to expected networks and are evaluated during sign-in and when the console session requests new credentials. Resource-based policies target individual AWS accounts while RCPs apply organization-wide via AWS Organizations. Administrators can combine these controls with AWS Management Console Private Access to manage allowed sign-in networks and account access across their environment.

🛡️ Enterprises are facing an invisible workforce: non-human identities (bots, service accounts, API keys, tokens, certificates) that now often outnumber humans. These ghost identities authenticate constantly across environments and, when unmanaged, accumulate privileges and risks. The industry has seen incidents where forgotten or third-party machine identities enabled widespread breaches, and a looming 2026 certificate-expiration wave threatens cascading outages. Organisations must prioritise governance—discovering NHIs, assigning ownership, auditing privileges, and addressing imminent certificate expirations—before tool selection.

🔐 This article demonstrates how to implement enterprise-grade authentication and authorization for a Streamlit sample application using Amazon Cognito for identity and Amazon Verified Permissions with Cedar policies for fine-grained access control. It outlines a layered architecture that separates identity verification, authorization evaluation, application logic, and enforcement to reduce blast radius. The post explains Cedar policy anatomy and common patterns—ownership, role-based, hierarchical, and emergency access—plus evaluation precedence where forbid policies take priority. Practical guidance covers required tools, provisioning steps, policy design tips, and testing recommendations to help developers scale secure applications.

🚀 Today AWS introduced cross-account and cross-role access for the AWS Model Context Protocol (MCP) Server, part of the Agent Toolkit for AWS. This update lets AI coding agents such as Kiro, Claude Code, or Codex operate across multiple AWS accounts and IAM roles within a single session without restarts. Previously, changing accounts required stopping the session, updating local credentials, and restarting the MCP server; now agents can specify a profile per command. The feature is intended to streamline multi-account workflows and reduce context-switch friction. The MCP Server is available in US East (N. Virginia) and Europe (Frankfurt).

🔁 Amazon Cognito now supports multi-Region replication, allowing near real-time synchronization of user and machine identity data — including credentials, user pool configurations, and federation setups — to a standby user pool in a designated secondary Region. This feature improves authentication resilience by providing a replica that can accept traffic during regional disruptions, preserving signed-in sessions and enabling users to authenticate with existing credentials. Multi-Region replication is offered as an add-on for user pools in the Essentials or Plus tiers and is available across multiple AWS Regions. Administrators can configure replication through the AWS Console, CLI, or SDKs; pricing and implementation guidance are provided in AWS documentation.

🔐 This post introduces the new inbound federation Lambda trigger for Amazon Cognito, which intercepts external IdP responses so you can transform, filter, and enrich attributes before a user profile is created. It explains how the trigger receives SAML and OIDC attributes, and outlines common B2B and B2C problems such as oversized group lists and duplicate accounts from different social sign-ins. The article shows how to normalize group attributes, filter excessive data, and implement automated account linking to maintain a single primary identity. It also covers performance and error-handling best practices for Lambda functions.

🔧 Amazon SageMaker Studio's quick setup now completes in under twenty seconds, down from over two minutes, letting users rapidly move from sign-in to a fully configured Studio environment. Newly created Studio environments automatically receive serverless model customization permissions via a new managed policy, AmazonSageMakerModelCustomizationCoreAccess, enabling fine-tuning, evaluation, and deployment without manual IAM role configuration. Existing environments receive actionable guidance to add the permissions. The feature is available in all AWS Commercial Regions that support SageMaker Studio.

🔒 This post shows how SaaS providers can use Amazon Bedrock AgentCore resource-based policies to control multi-tenant access to a shared AgentCore Runtime and Runtime endpoint. It walks through two tenant scenarios: cross-account access for Example Corp and VPC-restricted access for AnyCompany, demonstrating how to apply resource-level Allow and explicit Deny conditions. The article covers required IAM permissions, example policy files, and verification steps to ensure network- and identity-based constraints are enforced.

🔒 Amazon SageMaker Unified Studio now supports custom IAM permissions boundaries so organizations enforcing Service Control Policies (SCPs) can provision projects without changing their security posture. When creating a project, SageMaker provisions three IAM roles — a project user role, an Amazon Bedrock service role, and a Bedrock Lambda execution role — and administrators can specify a permissions boundary in the Tooling blueprint configuration. The boundary is attached to all three roles at creation, satisfying SCP requirements and limiting role capabilities while allowing automatic project provisioning across all supported AWS Regions.

🔐 Amazon Bedrock AgentCore Identity now lets customers reference existing AWS Secrets Manager secret ARNs directly in Credential Providers. Previously, secrets were service-managed and created by AgentCore Identity, limiting tagging, CMK encryption, and governance controls. Customers can now create and manage secrets with their own policies and then reference the ARN without changing runtime behavior. This feature is GA in 14 AWS Regions.