All news with #iam tag

🔧 IAM Policy Autopilot now analyzes Java applications and cross-references Terraform definitions to produce more precise IAM policies. The open-source tool, introduced at re:Invent 2025, already supported Python, TypeScript, and Go, and is available at no additional cost for local use. By resolving resource ARNs from Terraform, generated policies can avoid broad wildcard permissions and better enforce least-privilege. This update speeds policy creation and reduces time spent troubleshooting access issues.

🔐 Amazon announced new administration features for SageMaker Unified Studio that give administrators finer control over identity configuration and user management across both IAM and IAM Identity Center domain types. Administrators can now configure AWS IAM Identity Center for SSO onboarding, add IAM roles, users, and groups as project members, and manage domain users from a consolidated admin portal. For Identity Center domains, federated access through IAM roles now produces unique user sessions so collaborators sharing a role do not overwrite each other and actions remain auditable. These updates enable teams to use corporate IAM or IAM Identity Center identities consistently across domains and simplify collaboration and auditing in the Studio environment.

🛒 AWS Marketplace announces the Agreements API, enabling programmatic procurement and agreement management for Marketplace products. With this API you can generate estimates, accept offers, track charges and entitlements, update purchase orders, and manage agreements within your existing tools and workflows. Combined with the Discovery API, it supports an end-to-end procurement journey from product discovery to purchase and allows partners to build custom storefronts. The Agreements API is available in the US East (N. Virginia) Region; get started by configuring AWS Identity and Access Management permissions and calling the API via the AWS SDK.

🔒 AWS has announced general availability of the AWS MCP Server, a managed endpoint that gives AI coding agents secure, auditable access to AWS services using the Model Context Protocol (MCP). The server is part of the Agent Toolkit for AWS and enforces IAM-based guardrails while emitting CloudWatch metrics and CloudTrail logs so teams keep visibility and control. It supports calling any AWS API through a single tool, sandboxed Python execution for multi-step tasks without filesystem or shell access, and a new agent skills format for on-demand, curated procedures. The service is available at no additional charge; customers pay only for the AWS resources agents consume.

🛡️ Analysts and Orchid Security warn that enterprises are deploying AI agents faster than governance can keep up, creating an invisible layer of "identity dark matter" that conventional IAM misses. Orchid Security inspects applications at the binary and configuration layer to discover agents, audit compliance, and locate static credentials. Its Ask Orchid assistant answers natural-language questions about active agents, NIST compliance, and credential risks, then recommends prioritized remediation. This in-application observability aims to close the structural gap in identity visibility and enforce purpose-bound, least-privilege controls.

🔒 AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) now offers expanded STIG-aligned security settings focused on high-impact directory controls. These settings are available today through a self-service interface, both programmatically and via the AWS Management Console, enabling administrators to declare desired configurations and have AWS implement and persist them. When new domain controllers are added or directories are scaled or deployed in additional regions, AWS automatically applies the declared settings to new instances to maintain consistency.

🔔 Kaspersky reports an increase in phishing campaigns that abuse Amazon Simple Email Service (SES) to send authenticated-looking malicious messages that can bypass reputation-based filters. Attackers are harvesting exposed AWS access keys from public repositories and assets, automating secret discovery, permission checks, and mass email distribution. Because messages originate from a trusted service, SPF, DKIM, and DMARC checks and IP blocks are often ineffective, prompting Kaspersky to recommend stricter IAM controls, MFA, key rotation, and IP restrictions.

🔒 IAM Roles Anywhere now lets you include the CreateSession API in VPC endpoint policies, enabling explicit allow or deny controls for session creation through endpoints. If CreateSession isn't explicitly allowed (or you don't permit all operations, e.g., "rolesanywhere:*"), requests made via the VPC endpoint will not return temporary AWS credentials. This closes a prior gap and delivers consistent, fine‑grained access control across all IAM Roles Anywhere API operations, available in all regions including GovCloud, European Sovereign Cloud, and China.

🔐 Amazon Bedrock AgentCore Identity now supports On-Behalf-Of (OBO) token exchange, enabling developers to build agents that securely access protected resources on behalf of authenticated users without additional consent flows. The OBO exchange issues a new, scoped-down access token that carries both the user and agent identities, granting just-in-time, least-privilege access to outbound services. This capability is generally available in 14 AWS Regions.

🔐 AWS Payment Cryptography now supports Multi-party approval (MPA) for importing root certificates, adding an extra governance layer to critical key management operations. Organizations using X.509 and PKI with asymmetric keys (RSA, ECC) can require two or more authorized approvers even if the requester holds IAM permissions. The capability integrates with AWS IAM Identity Center so teams can review and act on pending requests through a managed approval portal, and it is available in all regions where the service runs with no additional charge beyond standard API rates.

📋 This blog by Rico Mariani outlines eight practical best practices for CISOs conducting risk reviews, focusing on identifying assets, applications, and access controls to shape review scope and priorities. It emphasizes good quality authentication (tokens and issuers like Microsoft Entra), robust authorization, network isolation, detection, and auditing to enable proactive security. The post also highlights commonly overlooked areas such as backups, support, and development systems to ensure comprehensive risk coverage.

🔐 AWS IAM Identity Center centralizes workforce access and can consume session tags from external SAML providers such as Microsoft Entra ID to enable fine‑grained, attribute‑based access control (ABAC) across multiple AWS accounts. By mapping directory group attributes to session tags, administrators can dynamically apply permissions and runtime configuration—examples include selecting an AWS Glue usage profile or configuring Systems Manager Session Manager run‑as behavior. The post walks through SAML and SCIM setup, creating a custom permission set, mapping claims (for example AccessControl:glue:UsageProfile), testing job creation in the Glue console, and validating session tags via CloudTrail AssumeRoleWithSAML events.

🔐 Cisco Talos’ Year in Review, authored by Hazel Burton, highlights how lower barriers to attack and rapid proof-of-concept development are stressing defenders. The report shows attackers increasingly rely on valid accounts, credential abuse, and management-plane targets while still producing detectable anomalous behavior. Recommended priorities include hardening IAM, prioritizing patching by exposure, improving visibility into legacy components, and securing systems that broker trust.

🔐 DORA's Article 9 makes credential management a binding financial risk control for EU financial entities, requiring least-privilege access, phishing‑resistant FIDO2/WebAuthn authentication, and cryptographic key protection. The regulation extends to third-party providers and mandates evidenceable controls. Organisations must deploy vaulting, JIT access, and continuous monitoring to reduce dwell time and meet supervisory expectations.

🔒 The contributor reframes AI agents as delegated identities rather than independent actors, arguing enterprises cannot safely govern agents without first governing the identities that delegate authority to them. It calls out pervasive "identity dark matter"—unmanaged human and machine credentials that create hidden permissions and execution paths which agents can amplify. The piece recommends sequencing remediation: first illuminate and reduce identity dark matter across humans, bots, and service accounts, then feed continuous telemetry into a real‑time delegation authority engine. Orchid's continuous observability model is presented as that live feed, enabling dynamic decisions to allow, recommend, constrain, or block agent actions based on delegator posture, intent, application context, and scope.

🔒 Amazon Quick now includes an ACL Permission Checker for knowledge bases with document-level ACLs, enabling administrators to verify whether a specific user can access a particular document without manually tracing permission inheritance. To use it, open a knowledge base with ACLs enabled, go to the Sync reports tab, choose View Access Details for any synced item, and enter the user's email in the Permission Checker to get an immediate result. The Access Details panel also lists all users and groups with access so administrators gain full visibility into applied permissions. The checker returns one of three outcomes: the user has access, the user does not have access, or no ACL was found for the document.

🛡️ Google has launched the Gemini Enterprise Agent Platform, a hub for managing agentic AI that assigns each agent a unique cryptographic ID to enable traceable, auditable actions and map to authorization policies. The platform centralizes agents, tools and skills in an Agent Registry and offers an Agent Gateway to enforce agent-to-agent and agent-to-tool policies, apply Model Armor protections, and support MCP and A2A protocols. New detection and security features include real-time Agent Anomaly Detection, an Agent Security dashboard integrated with Security Command Center, and specialized security agents for threat hunting, detection engineering and third-party context enrichment.

🔐 The UK’s National Cyber Security Centre (NCSC) now recommends passkeys as the preferred sign-in method for consumers, advising passwords only when passkeys are unavailable. This follows a year of collaboration with the FIDO Alliance, observed improvements across the passkey ecosystem and successful NHS deployments. The NCSC also urges businesses to adopt passkeys as the default and to use single sign-on (SSO) where possible, with additional business guidance expected.

🔐 Identity-centric systems have evolved from simple login mechanisms into the operational backbone of digital enterprises. By replacing the old network perimeter with a person- and device-centric model, modern identity frameworks enable fine-grained access control, real-time authorization and auditable accountability across cloud, mobile and distributed workforces. They also power customer personalization and fraud detection, helping teams move faster while reducing operational and security risk.

🔐 Amazon EKS now supports seven new IAM condition keys for cluster creation and configuration APIs, giving organizations finer-grained governance over cluster settings. Administrators can enforce private-only API endpoints, require customer-managed KMS keys for secret encryption, restrict approved Kubernetes versions, mandate deletion protection, set control plane scaling tiers, and enable zonal shift. The keys apply to CreateCluster, UpdateClusterConfig, UpdateClusterVersion, and AssociateEncryptionConfig APIs and integrate with Service Control Policies for centralized multi-account enforcement. They are available in all Regions where EKS is offered at no additional charge.