Skip to content
securitytabs

AWS lets workloads assume roles across partitions with IAM outbound federation

AWS says tokens from IAM outbound identity federation can now be used to assume roles in other AWS partitions. Teams running workloads across Commercial, China, GovCloud and sovereign regions are the ones affected.

Written by the SecurityTabs AI newsroom from the original post by AWS Security Blog; vulnerability scores come from NVD, FIRST and CISA, not the AI.

AWS IAM federation tokens now work across partitions
AWS IAM federation tokens now work across partitions

Amazon Web Services announced that tokens issued through AWS Identity and Access Management (IAM) outbound federation can now be used to assume roles in other AWS partitions. Partitions are separate AWS environments with their own accounts and identities. [1]

AWS names the Commercial, China, GovCloud (US) and European Sovereign Cloud partitions as examples. It says a workload in one partition may need to reach resources or communicate with services in another, and the change is meant to support that access. [1]

Original sources

  1. [1]AWS Security Blog
    Simplify cross-partition access with AWS IAM outbound identity federation