All news with #iam tag

🔐 This post introduces the new inbound federation Lambda trigger for Amazon Cognito, which intercepts external IdP responses so you can transform, filter, and enrich attributes before a user profile is created. It explains how the trigger receives SAML and OIDC attributes, and outlines common B2B and B2C problems such as oversized group lists and duplicate accounts from different social sign-ins. The article shows how to normalize group attributes, filter excessive data, and implement automated account linking to maintain a single primary identity. It also covers performance and error-handling best practices for Lambda functions.

🔧 Amazon SageMaker Studio's quick setup now completes in under twenty seconds, down from over two minutes, letting users rapidly move from sign-in to a fully configured Studio environment. Newly created Studio environments automatically receive serverless model customization permissions via a new managed policy, AmazonSageMakerModelCustomizationCoreAccess, enabling fine-tuning, evaluation, and deployment without manual IAM role configuration. Existing environments receive actionable guidance to add the permissions. The feature is available in all AWS Commercial Regions that support SageMaker Studio.

🔒 This post shows how SaaS providers can use Amazon Bedrock AgentCore resource-based policies to control multi-tenant access to a shared AgentCore Runtime and Runtime endpoint. It walks through two tenant scenarios: cross-account access for Example Corp and VPC-restricted access for AnyCompany, demonstrating how to apply resource-level Allow and explicit Deny conditions. The article covers required IAM permissions, example policy files, and verification steps to ensure network- and identity-based constraints are enforced.

🔒 Amazon SageMaker Unified Studio now supports custom IAM permissions boundaries so organizations enforcing Service Control Policies (SCPs) can provision projects without changing their security posture. When creating a project, SageMaker provisions three IAM roles — a project user role, an Amazon Bedrock service role, and a Bedrock Lambda execution role — and administrators can specify a permissions boundary in the Tooling blueprint configuration. The boundary is attached to all three roles at creation, satisfying SCP requirements and limiting role capabilities while allowing automatic project provisioning across all supported AWS Regions.

🔐 Amazon Bedrock AgentCore Identity now lets customers reference existing AWS Secrets Manager secret ARNs directly in Credential Providers. Previously, secrets were service-managed and created by AgentCore Identity, limiting tagging, CMK encryption, and governance controls. Customers can now create and manage secrets with their own policies and then reference the ARN without changing runtime behavior. This feature is GA in 14 AWS Regions.

🔔 AWS Organizations now emits CloudTrail events to the management account when member accounts join or leave an organization, introducing two new events: AccountJoinedOrganization and AccountDepartedOrganization. The join event records method (Created or Invited) and timestamp, while the depart event records mode (Left, Removed, or Cleaned) and timestamp. Administrators can use these events with CloudWatch alarms or EventBridge rules to enable real‑time notifications and faster incident response.

🔒 Amazon Connect Customer now supports tag-based access controls for the agent login/logout report, allowing administrators to apply granular permissions to meet compliance and regulatory needs. Contact center admins can use resource tags to limit who can view login/logout data for specific agents—for example, tagging agents with Department:Customer Service to allow only that team's manager to view their login/logout details. The feature is available in all AWS commercial and AWS GovCloud (US-West) regions where Amazon Connect Customer is offered.

🛠️ Amazon SageMaker Unified Studio now adds business context, metadata, and data governance features for IAM-based domains. Customers can annotate AWS Glue Data Catalog tables with business names, descriptions, and README documentation, and use AI-generated metadata to automate cataloging. Teams can build business glossaries, define metadata form templates, and capture structured attributes like classification, retention, and ownership. These capabilities enable search, filtering by glossary or metadata fields, and access requests with automated Lake Formation permission grants, and are available in all regions where SageMaker Unified Studio is supported.

🔒 AWS Managed Microsoft AD now supports CRUD operations on users and groups through the Directory Service Data APIs, accessible via the AWS CLI, APIs, and Management Console. This enables automation of identity lifecycle management and tighter security controls by integrating with services like Amazon GuardDuty, AWS Step Functions, and Amazon EventBridge. The blog demonstrates a practical workflow that detects unusual AD user behavior and triggers automated remediation such as disabling accounts and notifying stakeholders.

🔒 Amazon explains how AgentCore Gateway enforces a centralized authorization layer between autonomous agents and external tools, treating the LLM as an untrusted actor. Policies are expressed in the open-source Cedar language for readability, bounded execution, and mathematical analyzability, enabling deterministic enforcement and formal verification during policy authoring and attachment. A neuro-symbolic workflow translates natural-language rules into Cedar, validates them with Cedar Analysis, and enforces decisions at runtime to constrain tool invocations and filter unavailable actions.

⚠️Orchid Security's Identity Gap: Snapshot 2026 reveals that unseen, unmanaged identity elements now exceed visible ones, with 'identity dark matter' at 57% versus 43%. The report warns that rapid adoption of Agent AI amplifies risk because autonomous agents look for the most efficient access paths, often exploiting hard-coded or orphaned credentials and excessive privileges. Orchid urges strengthening identity and access management controls and using its readiness checklist to mitigate exposures.

🌐 AWS outlines how to present a single, brand-aligned vanity entry point (for example, aws.mycompany.com) in front of IAM Identity Center multi-Region access portals. The approach uses Amazon Route 53 latency-based routing, Application Load Balancer 302 redirects, and optional Amazon ARC Region switches for automated failover while TLS is managed through AWS Certificate Manager. Traffic is directed to the nearest healthy regional portal and the vanity domain does not persist in the browser address bar.

🛡️ Amazon Connect Customer now offers a permission that lets agents access only their own performance evaluations directly in the Connect UI. Agents can search for contacts where they received evaluations, view evaluations alongside call recordings and transcripts, and submit an acknowledgment after review. Administrators can grant department-level contact visibility for investigations while preventing access to peers' evaluation data. The feature is available in all AWS regions where Amazon Connect Customer is offered.

🔧 IAM Policy Autopilot now analyzes Java applications and cross-references Terraform definitions to produce more precise IAM policies. The open-source tool, introduced at re:Invent 2025, already supported Python, TypeScript, and Go, and is available at no additional cost for local use. By resolving resource ARNs from Terraform, generated policies can avoid broad wildcard permissions and better enforce least-privilege. This update speeds policy creation and reduces time spent troubleshooting access issues.

🔐 Amazon announced new administration features for SageMaker Unified Studio that give administrators finer control over identity configuration and user management across both IAM and IAM Identity Center domain types. Administrators can now configure AWS IAM Identity Center for SSO onboarding, add IAM roles, users, and groups as project members, and manage domain users from a consolidated admin portal. For Identity Center domains, federated access through IAM roles now produces unique user sessions so collaborators sharing a role do not overwrite each other and actions remain auditable. These updates enable teams to use corporate IAM or IAM Identity Center identities consistently across domains and simplify collaboration and auditing in the Studio environment.

🛒 AWS Marketplace announces the Agreements API, enabling programmatic procurement and agreement management for Marketplace products. With this API you can generate estimates, accept offers, track charges and entitlements, update purchase orders, and manage agreements within your existing tools and workflows. Combined with the Discovery API, it supports an end-to-end procurement journey from product discovery to purchase and allows partners to build custom storefronts. The Agreements API is available in the US East (N. Virginia) Region; get started by configuring AWS Identity and Access Management permissions and calling the API via the AWS SDK.

🔒 AWS has announced general availability of the AWS MCP Server, a managed endpoint that gives AI coding agents secure, auditable access to AWS services using the Model Context Protocol (MCP). The server is part of the Agent Toolkit for AWS and enforces IAM-based guardrails while emitting CloudWatch metrics and CloudTrail logs so teams keep visibility and control. It supports calling any AWS API through a single tool, sandboxed Python execution for multi-step tasks without filesystem or shell access, and a new agent skills format for on-demand, curated procedures. The service is available at no additional charge; customers pay only for the AWS resources agents consume.

🛡️ Analysts and Orchid Security warn that enterprises are deploying AI agents faster than governance can keep up, creating an invisible layer of "identity dark matter" that conventional IAM misses. Orchid Security inspects applications at the binary and configuration layer to discover agents, audit compliance, and locate static credentials. Its Ask Orchid assistant answers natural-language questions about active agents, NIST compliance, and credential risks, then recommends prioritized remediation. This in-application observability aims to close the structural gap in identity visibility and enforce purpose-bound, least-privilege controls.

🔒 AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) now offers expanded STIG-aligned security settings focused on high-impact directory controls. These settings are available today through a self-service interface, both programmatically and via the AWS Management Console, enabling administrators to declare desired configurations and have AWS implement and persist them. When new domain controllers are added or directories are scaled or deployed in additional regions, AWS automatically applies the declared settings to new instances to maintain consistency.

🔔 Kaspersky reports an increase in phishing campaigns that abuse Amazon Simple Email Service (SES) to send authenticated-looking malicious messages that can bypass reputation-based filters. Attackers are harvesting exposed AWS access keys from public repositories and assets, automating secret discovery, permission checks, and mass email distribution. Because messages originate from a trusted service, SPF, DKIM, and DMARC checks and IP blocks are often ineffective, prompting Kaspersky to recommend stricter IAM controls, MFA, key rotation, and IP restrictions.