AWS IAM Identity Center now supports network access controls for Identity Store

AWS IAM Identity Center is a service that enables employees to access AWS accounts and applications via single sign-on. It now supports network access control for the Identity Store, allowing restrictions on Identity Store API and SCIM API access based on the originating network. Custom applications and user provisioning workflows can manage and search users and groups using the Identity Store API, while external identity providers synchronize users and groups using the SCIM API. For the Identity Store API, you can require requests only from allowed VPC endpoints or specific source VPCs in an account or organization; both APIs can be restricted to specific IP ranges. Different limits can be applied to each API within the same settings-for example, requiring Identity Store API requests only from VPC endpoints while allowing SCIM requests from external identity provider public IP ranges. Network access control is optional and disabled by default. Requests made by AWS services on your behalf are exempt. This feature can be configured via the Identity Store API using the AWS SDK and AWS CLI, and is available in all AWS regions where IAM Identity Center is offered.

Why it matters

IAM Identity Center manages single sign-on for employees to AWS accounts and applications. This update enhances security by allowing access only from permitted networks.