AWS First Steps
Region expansion

AWS IAM identity federation to external services now available in AWS European Sovereign Cloud Region

AWS IAM now allows AWS workloads in the European Sovereign Cloud (Germany) Region to authenticate securely with external services using short-lived JWTs, eliminating the need for long-term credentials or complex workarounds.

AWS IAM introduces outbound identity federation for the European Sovereign Cloud (Germany) Region, enabling AWS workloads to authenticate with external services using short-lived JSON Web Tokens (JWTs). This eliminates the need for long-term credentials and complex workarounds when accessing third-party cloud providers, SaaS applications, and self-hosted services. Administrators can control token generation and enforce token properties such as lifetime, audience, and signing algorithms using IAM policies, with usage auditable via CloudTrail logs to meet security and compliance requirements.

Why it matters

This update affects users operating AWS resources in the European Sovereign Cloud environment, providing a secure way to access external services and enhancing security and compliance.

Read the original AWS announcement

Related articles and terms

AWS IAMAn authentication and authorization service for securely controlling access to AWS resources, providing fine-grained access management through users, groups, roles, and policiesDesigning Identity and Access Management - Achieving Zero Trust Security with IAMLearn access management design techniques with AWS IAM, including the principle of least privilege, policy design, and achieving zero trust security through Cognito integration.Single Sign-On with AWS IAM Identity Center - Multi-Account Access ManagementAchieve single sign-on for multi-account environments and control access levels to each account with permission sets. Covers external IdP integration and ABAC usage.Amazon CognitoA fully managed service that adds user authentication and authorization to web and mobile applications, with support for social login and SAML federationDetecting Excessive Permissions with IAM Access Analyzer - External Access and Unused Permission AnalysisDetect unused permissions on IAM roles using CloudTrail-based analysis and auto-generate least-privilege policies. This guide covers external access detection and integrating custom policy checks into your CI/CD pipeline.