AWS Adds Cross-Partition Identity Federation to IAM
Summary
AWS IAM outbound identity federation now supports access across AWS partitions. Workloads exchange short-lived signed JWTs for temporary credentials, with IAM trust conditions, access revocation controls, and CloudTrail events to support authorization and auditing.
Key points
- Workloads can obtain a short-lived signed JWT in one AWS partition and exchange it for temporary credentials in another, without storing long-term credentials.
- Destination IAM trust policies can constrain access using token claims including audience, source identity, account, organization ID, and source Region.
- AWS says CloudTrail events in both partitions share a token ID, allowing the JWT’s issuance and exchange to be correlated.
- The new aws:CrossPartitionSourceRegion condition key can restrict or deny access based on the Region where the source token was issued.
- Organizations can constrain federation origins or revoke access using IAM policies, resource control policies, and service control policies.
- The feature is available in AWS Commercial, China, GovCloud (US), and European Sovereign Cloud partitions at no additional cost; same-partition federation is not supported.
Article Details
- Event Type
- AWS expanded IAM outbound identity federation to support cross-partition access.
- Impact
- Workloads can obtain a short-lived, AWS-signed JWT in one AWS partition and exchange it for temporary credentials in another, enabling cross-partition resource access without storing or rotating long-term credentials. The feature supports origin-based trust-policy conditions, CloudTrail auditing across partitions, and credential revocation. AWS says it is available in all Regions in the Commercial, China, GovCloud (US), and European Sovereign Cloud partitions at no additional cost. Cross-partition access should be configured with least privilege and reviewed for compliance and security requirements.
Vendors
Products
Amazon S3This post walks through configuring cross-partition identity federation using Amazon Simple Storage Service (Amazon S3) data access as an example, but the same steps apply to any cross-partition API call.AWS CloudTrailCross-partition audit trail – AWS CloudTrail events in the destination Region include the source principal Amazon Resource Name (ARN), source Region, and a token ID that correlates back to the source Region’sAWS IAM outbound identity federationAWS IAM outbound identity federation already lets your workloads obtain a short-lived, AWS signed JSON Web Token (JWT) and use it to authenticate to external services.AWS Identity and Access ManagementYou can now use tokens from AWS Identity and Access Management (IAM) outbound federation to assume roles in other Amazon Web Services (AWS) partitions.AWS Security Token Service (AWS STS)Fully managed token infrastructure – AWS Security Token Service (AWS STS) issues, signs, and publishes verification keys for the JWTs.