AWS IAM Identity Center now supports optimistic locking for users and groups in its identity store

IAM Identity Center is a service that enables employees to access AWS accounts and applications with single sign-on. It supports optimistic locking for user and group identity stores, ensuring updates or deletions succeed only if the user or group has not changed since last read. This prevents silent overwrites when multiple administrators or automated workflows attempt to modify the same user or group simultaneously. Each user and group is assigned a revision value that updates whenever their attributes change, via SCIM provisioning, Active Directory sync, or the IAM Identity Center console. Current revision values are returned in create, describe, update, and list operations and can be passed in subsequent UpdateUser, UpdateGroup, DeleteUser, or DeleteGroup requests. Requests succeed only if the provided revision matches the current value; otherwise, a ConflictException is returned, allowing workflows to reload the user or group and retry with updated values. Specifying a revision is optional; omitting it behaves as before without affecting existing integrations. Conditional requests are supported through the Identity Store API but not SCIM endpoints. Group membership operations do not accept revision values, and adding or removing members does not change user or group revision values. This feature is available in all AWS regions where IAM Identity Center is offered, at no additional cost.

Why it matters

IAM Identity Center enables single sign-on access for employees to AWS accounts and applications. This update prevents conflicts when multiple administrators or automated workflows modify users or groups concurrently.