tag: Iam · 23 items
- Platform/SRE — Plan: New GA capability lets platform teams build automated identity lifecycle workflows — audit Lambda functions, SIEM alerts, or downstream access revocation triggered by group/user changes. Worth incorporating into identity management automation this quarter if IAM Identity Center is the identity source.
- CI/CD — Skip
- Leader — Learn: EventBridge-driven identity change events can strengthen automated compliance and audit posture for organizations managing large workforces in AWS; no strategic vendor or cost decision required, but informs thinking on identity automation capabilities.
- Platform/SRE — Plan: This GA capability removes the need for overly broad IAM roles in multi-Region architectures, enabling per-user fine-grained access control and audit trails across Regions. Teams running distributed or disaster-recovery workloads on AWS should evaluate updating their IAM Identity Center configuration and multi-Region access patterns this quarter.
- CI/CD — Skip
- Leader — Learn: Cross-Region identity propagation tightens the audit and access-control story for multi-Region AWS deployments without additional cost, which may eventually inform golden-path standards for identity architecture, but no strategic decision is required now.
- Platform/SRE — Learn: New GA machine-readable IAM service reference (global condition keys, service name mappings, IsDataPlane flag) is a useful building block for automating policy guardrails, but requires no immediate change to existing infrastructure.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New GA capability lets platform teams enforce IAM naming conventions and custom permissions boundaries across SageMaker Unified Studio projects via CloudFormation templates; worth evaluating if your org runs SageMaker Unified Studio, but no change required to existing infrastructure today.
- CI/CD — Skip
- Leader — Learn: Relevant to orgs with ML/data platform governance requirements — custom blueprints enable centrally enforced IAM and permissions standards, but this is a feature adoption opportunity, not a cost or vendor-risk decision.
- Platform/SRE — Plan: New GA capability to restrict Identity Store and SCIM API access by VPC endpoint or IP allowlist; evaluate enforcing VPC-endpoint-only access for the Identity Store API as part of your AWS SSO hardening roadmap this quarter.
- CI/CD — Skip
- Leader — Learn: AWS now allows network-level perimeter controls around the APIs that manage SSO users and groups; worth noting as an available hardening option when setting identity-security standards across accounts.
- Platform/SRE — Plan: If you operate in opt-in or GovCloud/China regions, evaluate enabling multi-Region IAM Identity Center replication this quarter to improve SSO resilience; requires setting up a multi-Region customer-managed KMS key for existing instances.
- CI/CD — Skip
- Leader — Learn: IAM Identity Center now supports identity replication across opt-in and GovCloud regions, a useful resilience capability to factor into multi-region access strategy and compliance planning.
- Platform/SRE — Plan: This simplifies multi-account automation at scale — teams managing SSM runbooks across an AWS organization can replace manual account-ID lists with OU/org-level RAM shares that auto-update as accounts join or leave. Worth adopting as part of your multi-account SSM document management strategy this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Teams running ElastiCache Global Datastore across regions can now enforce consistent IAM/SCP policies and cost allocation via tags; worth updating your tagging standards and IAM policies this quarter to close the permission-model gap.
- CI/CD — Skip
- Leader — Learn: This closes a cost-allocation and access-control gap in multi-region ElastiCache deployments, useful context if the org is standardizing FinOps tagging policies across AWS resources.
- Platform/SRE — Learn: Useful IAM pattern for multi-tenant HealthOmics workloads — session policies let you scope down permissions per run without proliferating IAM roles. No deadline; relevant only if you operate HealthOmics.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: The consolidated 4,096-byte limit and new CloudWatch/CloudTrail session token size metrics are worth noting for teams that use large inline policies or session tags in STS calls; no action required, no deadline, but the new metrics can surface token-bloat issues proactively.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: If your org runs ECS and uses IAM SCPs or permission boundaries to govern resource allocation, update your IAM policies to enforce ecs:task-cpu and ecs:task-memory on RunTask and StartTask — this closes a gap where those controls were previously bypassable at launch time.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Preview-stage feature that could simplify managing perimeters containing stale or deleted identities; worth evaluating if your GCP environment hits the invalid-email error today, but not actionable until GA.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: If Redshift is in your stack and you have data residency or network-isolation requirements, this is worth adopting: SSO via IAM Identity Center with all auth traffic staying inside your VPC via PrivateLink. Evaluate enabling EVR and wiring up Identity Center for your provisioned clusters or serverless workgroups this quarter.
- CI/CD — Skip
- Leader — Learn: Redshift now supports SSO via IAM Identity Center with network traffic fully contained in your VPC — relevant context if your org has regulatory or data-residency mandates for analytics infrastructure, but no decision is forced by this launch.
- Platform/SRE — Learn: Simplifies how Java workloads outside AWS obtain temporary credentials via Roles Anywhere without a sidecar process, worth knowing when evaluating hybrid or on-prem workload auth patterns.
- CI/CD — Learn: Relevant if build pipelines run Java workloads outside AWS that need AWS credentials; the plugin could replace credential_process workarounds, but no deadline or deprecation drives urgency.
- Leader — Skip
- Platform/SRE — Plan: Platform teams managing Lambda in multi-account architectures can now consolidate per-principal permission statements into single policy documents with full IAM condition key support (source IP, principal tags, etc.). Plan a policy consolidation pass for existing Lambda functions to reduce policy sprawl and simplify ongoing management.
- CI/CD — Skip
- Leader — Learn: This GA capability reduces IAM policy complexity for Lambda-heavy multi-account orgs, but it’s an incremental improvement rather than a strategic or cost-model shift — no leadership decision required.
- Platform/SRE — Plan: GA capability that simplifies multi-team DynamoDB Streams IAM policy management via tag-based conditions; worth adopting this quarter if you manage access across multiple environments or teams on DynamoDB Streams.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Relevant if your org runs SageMaker and Lake Formation with fine-grained data access; this GA feature removes the need for shared execution roles and adds per-user CloudTrail audit trails. No immediate action required unless you’re actively designing a multi-user analytics platform.
- CI/CD — Skip
- Leader — Learn: Per-user data boundaries enforced at the Lake Formation layer with automatic identity propagation reduces compliance friction for orgs with strict data governance requirements; worth noting when evaluating SageMaker Unified Studio for enterprise analytics use cases.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: If the org uses Bedrock for AI-grounded applications, this new IAM-gated capability lets models fetch live public web content, which may affect data-boundary and cost assumptions worth noting during the next AI tooling review.
- Platform/SRE — Plan: Platform engineers managing Terraform-deployed AWS infra can now generate least-privilege IAM policies directly from plan files rather than hand-crafting them; worth integrating into the IaC workflow this quarter to reduce wildcard usage and policy drift.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful S3 IAM debuggability improvement — policy ARNs now appear directly in 403 error messages, reducing time spent hunting down which SCP or identity-based policy caused a denial. No configuration required; available automatically across all regions.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Role manager can simplify onboarding new AWS services by auto-generating least-privilege starter roles, but teams with strict IaC discipline should evaluate whether console-created roles conflict with Terraform/CDK-managed IAM. Schedule a review of how role manager interacts with existing role governance before enabling org-wide.
- CI/CD — Skip
- Leader — Learn: Role manager lowers the barrier to correct IAM role setup for console-driven workflows, which may reduce misconfiguration risk across teams; worth noting as a governance tool but no immediate strategic decision required.
- Signals: GA announcement
- Platform/SRE — Learn: New configuration option for net-new IAM Identity Center instances reduces the service-linked role footprint when only AWS application SSO is needed. Worth noting for future greenfield deployments; no action required on existing instances.
- CI/CD — Skip
- Leader — Learn: Reduces the access surface when standardizing on IAM Identity Center for application SSO without requiring full AWS account management delegation — useful context when evaluating identity architecture for new AWS org setups.
- Platform/SRE — Plan: New GA Neptune capability that replaces static ARN enumeration in IAM policies with attribute-based cluster access using resource and principal tags; plan to adopt TBAC if you operate multiple Neptune clusters in shared VPC environments to enforce team and environment isolation.
- CI/CD — Skip
- Leader — Learn: Neptune now supports attribute-based access governance across clusters via IAM tags, useful context for organizations running Neptune at scale, but no strategic, licensing, or cost decision is triggered.