tag: Iam · 11 items
- Platform/SRE — Plan: If Redshift is in your stack and you have data residency or network-isolation requirements, this is worth adopting: SSO via IAM Identity Center with all auth traffic staying inside your VPC via PrivateLink. Evaluate enabling EVR and wiring up Identity Center for your provisioned clusters or serverless workgroups this quarter.
- CI/CD — Skip
- Leader — Learn: Redshift now supports SSO via IAM Identity Center with network traffic fully contained in your VPC — relevant context if your org has regulatory or data-residency mandates for analytics infrastructure, but no decision is forced by this launch.
- Platform/SRE — Learn: Simplifies how Java workloads outside AWS obtain temporary credentials via Roles Anywhere without a sidecar process, worth knowing when evaluating hybrid or on-prem workload auth patterns.
- CI/CD — Learn: Relevant if build pipelines run Java workloads outside AWS that need AWS credentials; the plugin could replace credential_process workarounds, but no deadline or deprecation drives urgency.
- Leader — Skip
- Platform/SRE — Plan: Platform teams managing Lambda in multi-account architectures can now consolidate per-principal permission statements into single policy documents with full IAM condition key support (source IP, principal tags, etc.). Plan a policy consolidation pass for existing Lambda functions to reduce policy sprawl and simplify ongoing management.
- CI/CD — Skip
- Leader — Learn: This GA capability reduces IAM policy complexity for Lambda-heavy multi-account orgs, but it’s an incremental improvement rather than a strategic or cost-model shift — no leadership decision required.
- Platform/SRE — Plan: GA capability that simplifies multi-team DynamoDB Streams IAM policy management via tag-based conditions; worth adopting this quarter if you manage access across multiple environments or teams on DynamoDB Streams.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Relevant if your org runs SageMaker and Lake Formation with fine-grained data access; this GA feature removes the need for shared execution roles and adds per-user CloudTrail audit trails. No immediate action required unless you’re actively designing a multi-user analytics platform.
- CI/CD — Skip
- Leader — Learn: Per-user data boundaries enforced at the Lake Formation layer with automatic identity propagation reduces compliance friction for orgs with strict data governance requirements; worth noting when evaluating SageMaker Unified Studio for enterprise analytics use cases.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: If the org uses Bedrock for AI-grounded applications, this new IAM-gated capability lets models fetch live public web content, which may affect data-boundary and cost assumptions worth noting during the next AI tooling review.
- Platform/SRE — Plan: Platform engineers managing Terraform-deployed AWS infra can now generate least-privilege IAM policies directly from plan files rather than hand-crafting them; worth integrating into the IaC workflow this quarter to reduce wildcard usage and policy drift.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful S3 IAM debuggability improvement — policy ARNs now appear directly in 403 error messages, reducing time spent hunting down which SCP or identity-based policy caused a denial. No configuration required; available automatically across all regions.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Role manager can simplify onboarding new AWS services by auto-generating least-privilege starter roles, but teams with strict IaC discipline should evaluate whether console-created roles conflict with Terraform/CDK-managed IAM. Schedule a review of how role manager interacts with existing role governance before enabling org-wide.
- CI/CD — Skip
- Leader — Learn: Role manager lowers the barrier to correct IAM role setup for console-driven workflows, which may reduce misconfiguration risk across teams; worth noting as a governance tool but no immediate strategic decision required.
- Signals: GA announcement
- Platform/SRE — Learn: New configuration option for net-new IAM Identity Center instances reduces the service-linked role footprint when only AWS application SSO is needed. Worth noting for future greenfield deployments; no action required on existing instances.
- CI/CD — Skip
- Leader — Learn: Reduces the access surface when standardizing on IAM Identity Center for application SSO without requiring full AWS account management delegation — useful context when evaluating identity architecture for new AWS org setups.
- Platform/SRE — Plan: New GA Neptune capability that replaces static ARN enumeration in IAM policies with attribute-based cluster access using resource and principal tags; plan to adopt TBAC if you operate multiple Neptune clusters in shared VPC environments to enforce team and environment isolation.
- CI/CD — Skip
- Leader — Learn: Neptune now supports attribute-based access governance across clusters via IAM tags, useful context for organizations running Neptune at scale, but no strategic, licensing, or cost decision is triggered.