AWS IAM Identity Center now supports cross-Region trusted identity propagation
IAM Identity Center's cross-Region trusted identity propagation automatically propagates user identity across AWS Regions, enabling fine-grained access control and auditing while granting access based on user and group associations
Trusted identity propagation assigns user identity to requests, allowing AWS services to grant permissions based on user and group membership, and logs this information. Cross-region support extends this identity context to AWS services running in different regions, increasing flexibility for cross-region architectures and deployments. Customers distribute workloads across AWS regions for reasons such as isolating compute and query data, running workloads where capacity exists, disaster recovery, and global scale. Previously, trusted identity propagation required all AWS services accessing user identity to be in the same region. To access services in another region, permissions had to be granted through broad IAM roles that could not distinguish individual users, or all services had to be centralized into a single region. With cross-region trusted identity propagation, user identity automatically propagates across AWS regions with each request, enabling fine-grained access control based on user and group membership while auditing which resources were accessed. Cross-region trusted identity propagation is available in all AWS regions where IAM Identity Center is offered, at no additional cost. For a list of regions where IAM Identity Center is available, see AWS Capabilities by Region. For more details, see Trusted identity propagation in the IAM Identity Center user guide.
Why it matters
IAM Identity Center is a service for managing access to AWS resources. This update allows users to maintain fine-grained access control for individual users when distributing workloads across AWS Regions
Regions: Same as AWS IAM Identity Center