AWS Shares PKI Best Practices for IAM Roles Anywhere
Summary
AWS outlines how to integrate external PKI with IAM Roles Anywhere, including certificate-based workload identities, scoped trust policies, temporary credentials, private-key protection, certificate-expiry monitoring, and rotation.
Key points
- Assign distinct X.509 certificates and IAM roles to workloads, and use certificate attributes such as issuer, subject, and SAN values to constrain trust policies.
- Limit each session’s effective permissions with appropriately scoped roles and session policies.
- Use short-lived or just-in-time certificates where supported to reduce exposure from compromised certificates.
- Protect private keys with PKCS #11-compatible secure stores, HSMs, TPM 2.0, or supported operating-system certificate stores rather than storing keys on disk.
- The credential helper’s serve command provides temporary credentials through a local endpoint; update writes credentials to a file, which may be readable by other users or processes.
- Monitor CA and end-entity certificate expiry, and use automated blue/green deployments to test trust-anchor certificate rotation before production rollout.
Article Details
- Defense Focus
- Secure workload identity and temporary AWS access by strengthening certificate trust, authorization, private-key protection, certificate lifecycle management, and expiry monitoring.
- Detection Methods
- Monitor CA and end-entity certificate expiry through IAM Roles Anywhere notifications; the article gives 45 days before expiry as the default threshold and says it can be customized.
- Data Sources
- Certificate-expiry metrics, events, and notifications for CA and end-entity certificates.
- Defensive Actions
- Issue distinct X.509 certificates and machine identities for separate workloads, and configure distinct IAM roles with least-privilege permissions.
- Restrict role assumption with trust-policy conditions on certificate issuer, subject, and SAN attributes, and scope the policy to the intended trust-anchor ARN.
- Use session policies and appropriately limited session durations to constrain temporary credentials.
- Use short-lived or just-in-time certificates where supported, with validity periods aligned to workload needs and risk tolerance.
- Protect private keys with PKCS #11-compatible secure stores, HSMs, TPM 2.0 non-exportable keys, or supported operating-system certificate stores; avoid storing keys in online repositories.
- Prefer serving temporary credentials through the credential helper's local endpoint over writing credentials to disk, unless a file-based workflow is specifically required.
- Rotate trust-anchor certificates through automated blue/green deployment, testing the rotation in staging before production.
- Automate certificate-expiry monitoring and customize notification thresholds as needed.
Vendors
Products
AWS Certificate Manager (ACM)Note: As of July 2026, AWS Certificate Manager (ACM) supports exportable public certificates that can be used on workloads outside AWS (containers or on-premises).AWS Private CAcertificate as a trust anchor or by referencing an existing AWS Private Certificate Authority (AWS Private CA) certificate.IAMWith AWS IAM Roles Anywhere, now your workloads outside of Amazon Web Services (AWS) will be able to access AWS resources by obtaining temporary security credentials in AWS Identity and Access Management (IAM).IAM Roles AnywhereWith AWS IAM Roles Anywhere, now your workloads outside of Amazon Web Services (AWS) will be able to access AWS resources by obtaining temporary security credentials in AWS Identity and Access Management (IAM).